Cybersecurity Starts in the Boardroom
When a threat actor compromises the coding of software the problems can be widepread – the SolarWinds attack and subsequent distribution of the infected software through legitimate update channels is a classic example. (Ironic but the SolarWinds customers who avoided the attack, were those with a poor cyber security stance …
Continue reading “Back to the supply chain and software compromise”
Usually when I am discussing smartphone app security, Apple iOS has an advantage over Android apps, because of it’s curated App store that stops (most) of the security issues from getting through to the end user’s devices. Now researchers have discovered Amazon Web Service credentials hard coded, by careless developers …
Continue reading “This time there is more of a security issue with iOS rather than Android”
I have written before about how good “bug bounties” are for improving everyone’s cyber security, rewarding the white hat hackers and researchers for their work. The Open Source Software Vulnerability Rewards Program (OSS VRP) Now Google has launched a bug bounty program that rewards the ethical technologists for finding and …
If you, as a threat actor, could embed your malware into a software module, that is then used by many innocent and unaware software developers in their packages, they release to the general public, wouldn’t you? That looks like a lot of infected machines for a small amount of work. …
Continue reading “Software repositories are a target for threat actors”
Keeping your software up to date is important for all of us – doubly so if you are the people producing the code: GitLab ‘strongly recommends’ patching critical RCE vulnerability (bleepingcomputer.com)
