DARPA’s AI Challenge, CISA Wants Secure Open Source, 5 Years of Vuln Research – ASW #251

Mike Shema

1. DARPA Launches 2-Year Contest to Build AI Tools to Fix Vulnerabilities

   A new challenge to coax AI into figuring out how to identify and fix software flaws. The challenges will be across many programming languages, but have half of them focused on memory-safety issues in C and C++.

   I'd be curious to see a challenge that rewrote a program in C into Rust.

   Check out the OpenSSF announcement.

   Keep an eye on the contest's home page.

2. Microsoft’s red team has monitored AI since 2018. Here are five big insights | ZDNET

   We covered comments from Google's red team targeting AI back in episode 248. Here's a similar article from Microsoft.

   A few things stand out from "normal" red team exercises. One, this testing is more expensive. Two, it requires repeated attempts. Three, and more interesting to me, is testing how such systems might generate harmful content for average users. In other words, the testing is just figuring out what a malicious actor might do, but what the system might do to a benign user.

3. White House, CISA call for help with security of open source software

   CISA wants to push the industry to secure by default and secure by design. A big part of this is moving towards memory-safe languages. Another part is asking the industry where they think major investments in effort should go.

   Check out the Request for Information. You have until October 9, 2023 to respond.

4. The Pithy P2P: 5 years of vulnerability remediation & exploitation research

   There's a lot in here about what vulnerability management programs should focus on and how they can be efficient and effective. For example, focusing on high-risk vulns (as indicated by CVSS) combined with exploitation. It's important to have good visibility into the vulns across an org, but it's also important to realize that not all of those vulns require remediation.

5. ‘Downfall’ Bug in Billions of Intel CPUs Reveals Major Design Flaw

   Yet another look at CPU-related security, this time in memory leaks in the Linux kernel and what a user space program can get out of it -- like encryption keys.

   Mostly including this just to show how exploits improve and emerge over time. This research points out that bugs that were seemingly unexplainable (in terms of an RCE) or that lead to a DoS now have an additional security consideration.

6. VS Code’s Token Security: Keeping Your Secrets… Not So Secretly – Cycode

   We've got secrets managers in the cloud, secure enclaves on user systems, and lots of API security tokens floating around that need protection.

   This is also a chance to talk about API security and different models like shared secrets, asymmetric signing keys, and HMACs.

7. Badge of Shame – Breaking Into Secure Facilities with… | Bishop Fox

   Another example of an "install mode" that may persist after the install and consequently be used to obtain encryption keys.

8. FYI: NSA: Codebreaker Challenge Helps Drive Cybersecurity Education

   "This year's Codebreaker Challenge will center around a simulation in which the US Coast Guard identifies a signal about 30 miles off the coast of the continental US; participants will be asked to interpret and find the origin of the signal."

   Keep an eye on the official site. The challenge runs from Sept. 28 through Dec. 21.

9. Smashing the state machine: the true potential of web race conditions

John Kinsella

1. Shamir Secret Sharing, or how to break your fancy encryption setup

   Max Levchin tells a story about how he used Shamir Secret Sharing to protect encryption on Paypal's database - and how it first broke when they put it into production.

   (h/t Bill)

2. Satellite CTF at defcon

   Always nice to see my curiosity with space appsec filter over to to the side my political nerd side also reads ????

3. Parsing vulnerability in Python’s urllib.parse()

   Turns out urlsplit() and urlparse() don't do input validation. Whoops.

4. Google launching LLM-powered IDE

   I'm on the waiting list so haven't gotten to play with it, but Google's announced IDX - a Visual Studio-based IDE with some of Google's flavor of LLM built into it to assist in coding. I keep hoping these things will produce more secure code...

5. Stability AI announces open source model for generative AI coding

   The folks who funded most of the development of Stable Diffusion (one of the first to kick off the current generative AI fashion period) have released Stablecode - a LLM focused on software development. The model's up on huggingface - start your coding!

6. AI won’t replace humans – but humans with AI will replace humans without

   This interview over on HBR includes a message I can really get behind: Don't worry so much about AI/computers taking over the world, but if you don't understand how to leverage these new tools, you may find it difficult to keep up with those who do.

7. IOT maker warns malware attack cycles increasing

   This is an interesting read of how an IOT manufacturer could take a more proactive stance about understanding the threats against their products, and spend some resources working to improve the security situation.

   (apologies if this is paywalled - it seems available to me)

8. New Intel patches will be the downfall of your fancy CPU’s performance

   Intel got patches out for Downfall fairly quickly, but they'll take up to 39% of your CPU's performance, unfortunately.

   (thanks to Phoronix for always creating great low-level Linux articles)

9. VSCode isn’t keeping secrets so secret

   The folks at cycode developed a POC extension for VSCode which doesn't just get security tokens from other plugins, but also the GitHub/Microsoft tokens for login/sync functionality. They went beyond that and provided a great writeup about how they worked through figuring out how to get their POC extension to do what they want