CramHacks Chronicles #28: Weekly Cybersecurity Newsletter!

🥳 Happy Monday! 🥳

I’m currently working towards gaining a better understanding of public package repositories. Publishing a package on each seemed like the easiest way to start!

So far, I’ve done Composer (PHP), NPM (Node), and PyPI (Python). In terms of ease of publication (easiest → hardest), Composer has been the easiest, followed by Node and then Python. Of course, security vs convenience has appeared because the reverse order would be my security ranking, solely from a package maintainer perspective.

Table of Contents

• Application Security

• Artificial Intelligence

• Miscellaneous

• Software Supply Chain Security

• Until Next Time! 👋

Application Security

Trail of Bits: Read code like a pro with our weAudit VSCode extension
Filipe Casal announces the release of a VSCode extension that assists code reviews by offering features such as bookmarks, tracking of audited files, collaboration, and creating GitHub issues. Available via the VSCode Marketplace and GitHub.

TypeScript: Integrating Branded and Tainted Types
Allan Reyes shares a real-world application for branded and tainted types and then uses Semgrep to detect and enforce their usage.

I like how Allan phrased it here regarding his simple example, where a validator was embedded into the Brand: “These mean that developers don’t have to think, ‘Gee, do I have to validate this?’ They can totally evict that from their brains. The type will exist only if it’s already validated.”

👋 Secure-by-default, guardrails, whatever you want to call it… Do this. Part 2, Tainted Types, can be found here. Additionally, as referenced in the blog post, this thread by Matt Pocock is 🔥.

ReverserAI (OSS): Automate reverse engineering tasks
Tim Blazytko shares ReverserAI, a Binary Ninja plugin designed to automate and enhance reverse engineering tasks. The special sauce is that this project leverages locally hosted large language models (LLMs), operating entirely offline.

Artificial Intelligence

NVIDIA Blackwell Platform Arrives to Power a New Era of Computing
NVIDIA announces Blackwell technologies, which enable efficient real-time operation of models up to 10 trillion parameters, reducing cost and energy consumption by up to 25x.

Security Flaws within ChatGPT Ecosystem Allowed Access to Accounts On Third-Party Websites and Sensitive Data

Department of Homeland Security Unveils Artificial Intelligence Roadmap
DHS is initiating three pilot projects to responsibly harness AI for Homeland Security missions, ensuring privacy and civil rights, enhancing national AI safety and security, and fostering leadership through strategic partnerships.

Apple Is in Talks to Let Google Gemini Power iPhone AI Features
Bloomberg reports that Apple is actively negotiating with Google to license Gemini for new features coming to iPhone software in 2024. Apple and OpenAI are also in ongoing discussions.

Miscellaneous

Former Telecommunications Company Manager Admits Role in SIM Swapping Scheme
Jonathan Katz, aka “Luna,” 42, of Marlton, New Jersey, pleaded guilty to conspiracy to gain unauthorized access to a protected computer. Katz was the manager at a telecommunications store and abused his credentials to swap SIM numbers, enabling individuals to control other customers’ phones and access their electronic accounts. Katz was paid in Bitcoin.

👋 His Bitcoin account received a total of $5,000; meanwhile, his offense “carries a statutory maximum of five years in prison and a fine of not more than $250,000 or twice the pecuniary gain to the defendant or twice the gross loss involved, whichever is greater.” Was it worth it? 🤔 

Repository for Software Attestation and Artifacts Now Live
“Software producers who partner with the federal government can now upload their Secure Software Development Attestation Forms to CISA’s Repository for Software Attestation and Artifacts. “

Massive ‘Apex Legends’ Hack Disrupts NA Finals, Raises Serious Security Concerns
👋 There’s a lot of speculation going on, so I will add to it. My guess is that the player unknowingly installed a trojan/malware.

Software Supply Chain Security

An open letter to Congress to support NIST and the NVD
Following the NIST slowdown and lack of vulnerability data enrichment, Dan Lorenc, Chainguard Founder & CEO, has organized a crowdsourced draft letter to Congress. This letter aims to emphasize the criticality of the NVD and the potential implications which may result from a lack of support or funding.

Until Next Time! 👋 

Hey, you made it to the bottom – thanks for sticking around!

Questions, ideas, or want to chat? Slide into my inbox! 💌

Don’t hesitate to forward if someone could benefit from this.

See you next Monday!
-Kyle