Adam Fishman’s Post

Should Developers Fear Shift-Left Security? Let's Discuss! ️ As a newbie on my tech journey , I attended the GitHub Galaxy Virtual EMEA event last week. Among the sessions, the one that grabbed my attention was the discussion on "shift-left" and software security. During the live chat, someone mentioned that this approach can be disconcerting to some developers, fearing that security written by AI itself might be vulnerable to attacks by another AI model or code. This sparked my curiosity, and I dove into searches on Google and Reddit to understand the potential drawbacks . 💡Here's what I learned: In the software development lifecycle, "shift-left" is a compelling concept. The idea is to  integrate security testing  earlier in the development process rather than waiting until later stages ⏩. This can be more efficient and cost-effective because it allows for earlier detection and fixing of vulnerabilities . However, it's important to remember that testing is a distinct skillset from development ≠. Companies need to  ensure clear communication with their development teams. Developers can only do so much – writing secure code requires a different skillset and might be better suited for a separate security team . One concern is that overly continuous testing during development can slow down progress. If developers are constantly revisiting code based on new test results, particularly weeks after a task is completed, it can hinder their ability to move forward with new features. Another potential drawback is the reusability of test models ♻️. While reusing models from previous projects can save time, it's crucial to ensure these models are thoroughly reviewed and updated to avoid inheriting vulnerabilities from past projects. #GitHubGalaxy #softwaredevelopment #dev #AI #learnprogramming #cybersecurity #testing #shiftleft

AI-powered software development is gaining popularity in the cyber community, but it's critical that engineers proceed with caution ⚠️ Our CEO Mehran Farimani urges developers to pay close attention to what is being generated when leveraging these tools, as accurate results are never guaranteed. #RapidInsights #AI #SoftwareSecurity #Developers

🎯 𝗪𝗮𝗻𝘁𝗲𝗱: 𝗦𝗲𝗻𝗶𝗼𝗿 𝗢𝗳𝗳𝗲𝗻𝘀𝗶𝘃𝗲 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝗽𝗲𝗿𝘁 ⚠️ Ready for a new challenge where you can flex your hacking muscles? Join us in securing the future of the Swiss and Spanish financial markets, and be a part of a team that values innovation, teamwork, and a good amount of fun in tackling serious challenges. 𝗬𝗼𝘂𝗿 𝗠𝗶𝘀𝘀𝗶𝗼𝗻 𝗔𝘄𝗮𝗶𝘁𝘀: 🛡️ Penetrate and Protect: Undertake (covert) operations in penetration testing and red team missions. 🏹 Bounty Hunter: Track down bugs with the tenacity of a seasoned hunter. 🤖 Automation Wizard: Weave Python spells to conjure tools that enhance our offensive tooling. 🗣️ Strategist and Scholar: Champion security intelligence, mentor peers, and uplift the whole team with your knowledge. 𝗪𝗲 𝗡𝗲𝗲𝗱 𝗬𝗼𝘂 𝗜𝗳: 👥 Team Spirit: Your skills do the talking, but your communication skills amplify your impact. 🎖️ Veteran of Cyber Battles: Your portfolio of victorious hacking campaigns speaks for itself. 💻 Programming Prodigy: Python is your chosen tool to architect offensive or defensive security tools. 📚 Eternal Learner: For you, every problem is a puzzle waiting to be solved, a lesson waiting to be learned. 𝗝𝗼𝗶𝗻 𝗠𝘆 𝗧𝗲𝗮𝗺: Sharpen your skills, and let's protect the Swiss and Spanish financial markets together. 🔗 Apply Here: https://lnkd.in/gGu8a85v SIX | BME | Bolsas y Mercados Españoles #job #offensivesecurity #hacker #penetrationtest #redteam #bugbounty #hiring #WeAreSIX #discoverSIX #SIXcareers #TheFutureofFinanceIsNow

Google has taken a significant step in fortifying software security by offering free access to its fuzzing framework, OSS-Fuzz. Fuzzing proves to be a pivotal tool in unearthing zero-day vulnerabilities, and Google aims to empower developers and researchers by providing open access to its fuzzing capabilities. The key innovation lies in leveraging large language models (LLMs) to automate manual aspects of fuzz testing. The Google team utilized LLMs to generate project-specific code, enhancing fuzzing coverage and revealing more vulnerabilities. This methodology has already borne fruit, with Google identifying two previously undiscovered vulnerabilities in widely used projects cJSON and libplist. Dave (Jing) Tian, an assistant professor of computer science at Purdue University, emphasizes the critical balance between automation and safety in the patching process. While automation plays a role in simpler patches, complex ones still demand expert scrutiny to ensure precision and effectiveness. In conclusion, Google's OSS-Fuzz, coupled with LLM-generated improvements, marks a stride forward in fortifying software security, underscoring the importance of a nuanced approach to patching in the ever-evolving landscape of cybersecurity. #OSSFuzz #Cybersecurity #GoogleTech

#GPT-4 Is Capable Of Exploiting 87% Of One-Day Vulnerabilities Large language models (#LLMs) have achieved superhuman performance on many benchmarks, leading to a surge of interest in LLM agents capable of taking action, self-reflecting, and reading documents.  While these agents have shown potential in areas like software engineering and scientific discovery, their ability in cybersecurity remains largely unexplored.  #Cybersecurity researchers #Richard Fang, #Rohan Bindu, #Akul Gupta, and #Daniel Kang recently discovered that GPT-4 can exploit 87% of #one-day #vulnerabilities, which is a significant advancement. https://lnkd.in/gkteV7ZT

Checkmarx has uncovered a threat actor that has been quietly infiltrating the open-source ecosystem for nearly six months, planting malicious Python packages with a focus on deception and financial gain. The malicious actor employed a systematic approach, disguising their packages with names closely resembling popular legitimate Python packages. These decoy packages, camouflaged to blend in, successfully garnered thousands of downloads. The malicious payload, embedded within the setup.py file, executed upon installation, showcasing a level of sophisticationTo appear more legitimate, the attacker utilised the domain ‘api-hw.com’ for downloading payloads. However, the loss of control over the domain indicates a potential shift in strategy or a retreat. The campaign uncovered by Checkmarx serves as a stark reminder of the persistent threats targeting the open-source ecosystem. Developers must exercise caution, vet packages, and leverage security assessment platforms to make informed decisions and reduce risks in their DevOps pipelinesOne notable aspect of the attack involved steganography, hiding a malicious payload within an innocuous-looking image file. This technique added an extra layer of stealth, making detection challenging. The attack demonstrated a consistent pattern, with code exhibiting similar obfuscation techniques and harmful payloads. The Python packages, both camouflaged and direct, showcased a common blueprint. The attacker – aiming for persistence on compromised systems – employed scripts that identified users, created specific directories, placed and executed files, and covered their tracks post-execution. The ultimate goal of the packages was clear: gain persistence, steal sensitive information, and achieve financial gains. The attacker targeted cryptocurrency assets, with a focus on stealing financial data. Stolen information was stored in separate files and exfiltrated to specific endpoints. The attacker went beyond direct attacks, creating packages masquerading as API management tools. These packages – named “Pystob” and “Pywool” – enticed victims to deliberately download them, revealing obfuscated code and a multi-layered malicious payload #artificialintelligence #intelligence #machinelearning #programming #python #softwaredeveloper #webdeveloper #software #devlife #programmerlife #developers. #techno #technology #engineering #engineeringtech #engineering_life #ingenious #makine

What a timely release - the OWASP Top 10 For Large Language Model Applications list. Thanks to OWASP® Foundation for this major undertaking, building on the collective expertise of an international team of nearly 500 experts, with over 125 active contributors. Developers, data scientists, and security experts tasked with designing and building applications and plug-ins leveraging #LLM technologies will be well served by this collective wisdom and best practices. #AI #GenAI #Cybersecurity Get your own copy of the list here. https://genai.owasp.org/# Intelliswift Software

In this video tutorial, you will learn how to train a model to identify hate speech sentences. https://lnkd.in/dT45S7sP #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource #Linux #windows

ICYMI: Bredec Group BredecDevelopment GPTs, Software Engineering, and a New Age of Hacking | GJIA - Georgetown Journal of International Affairs: GPTs, Software Engineering, and a New Age of Hacking | GJIA  Georgetown Journal of International Affairs inquiry@bredec.com Inquiry@bredec.com