All the News — Just Six Months Later – ASW #265
We cover appsec news on a weekly basis, but sometimes that news is merely about the start of a new project, sometimes it's yet another example of a vuln class, and sometimes it's a topic we hope doesn't become a trend.
So, what themes have we seen and where do we see them going? Here are a few headline topics that have alternately generated yays and yawns.
- CISA's Secure by Design and Secure by Default
- CVSS 4.0
- Generative AI
- MFA mandates
- Microsoft, Rust, and Memory Safety
- New TLDs
- OAuth
- OpenSSF and OWASP
Extracting Data from ChatGPT, Vulns Around AI, Secure AI Guidance, LogoFAIL, BLUFFS – ASW #265
Repetition extracts data from ChatGPT, more vulns in the software that surrounds AI, guidelines for secure AI, LogoFAIL trips a boot, BLUFFS attack on Bluetooth, CISA's first secure by design alert, Okta's updated breach disclosure, and more!
Mike Shema
- Extracting Training Data from ChatGPT
As Duran Duran might say, "Please, please tell me now". Or rather "please, please, please, please" repeated a few dozen times before ChatGPT tells you some of its verbatim training data.
Check out the research paper, https://arxiv.org/abs/2311.17035 (PDF).
- Ray, Versions 2.6.3, 2.8.0 | Bishop Fox
- UK and US develop new global guidelines for AI security
Read the guidelines here.
- CISA Releases First Secure by Design Alert
- The Far-Reaching Consequences of LogoFAIL | Binarly – AI -Powered Firmware Supply Chain Security Platform
- BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses | Daniele Antonioli
The Bluetooth SIG's recommendations.
- October Customer Support Security Incident – Update and Recommended Actions
Good for transparency, not good for all customers. The practical consequences to customers seems minimal, but the reputational consequences to Okta remain.
There's also so little transparency elsewhere, that it's hard to put this breach into perspective in terms of how long it took to investigate and how much the disclosure is revised based on ongoing analysis. It doesn't feel like this situation is out of the ordinary.
Overall, the industry still needs to have less sso.tax and more strong MFA adoption -- including resilience for multi-tenant systems and processes that are resistance to social engineering.
- TOOL: Nikto 2.5.0 Released!
Wow -- Nikto is still under (sort of) active development!
Less wow -- Nikto is still written in Perl.
John Kinsella
- RCE in Splunk Enterprise
Everybody's favorite most expensive web grep has a remote code execution vulnerability where a malicious user can upload a XSLT that results in remote code execution. Nathan digs into the vuln and reverse engineers a POC in his first blog post!
- 40 years of Turbo Pascal
What language did you start with?
- IBM announces WatsonX code assistant
IBM is previewing their "enterprise grade AI code generation" in Watsonx code assistant - looks like a plugin for VSCode.
