Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Roy Blit
How to Reduce the Risk of Using External AI Models in Your SDLC
Understand how AI models add risk and how to address it. In the rapidly evolving landscape of artificial intelligence (AI), many organizations are turning to third-party AI models to enhance their software development processes . These models, developed externally, offer many benefits, from accelerating development timelines to introducing cutting-edge functionalities without need ing in-house expertise .
Roy Blit
By Roy Blit OpenSSL has announced a critical fix in version 3.0.7 to be released Nov 1, 2022. It means that on Tuesday Nov 1 the race will start between those who patch and those who exploit. In this blog post, we'll summarize all the necessary information required to make sure you can ... Read More
GitHub, PyTorch and More Organizations Found Vulnerable to Self-Hosted Runner Attacks
Last July, we published exploring the dangers of vulnerable self-hosted runners and how they can lead to severe software supply chain attacks. A recent blog post by security researcher and bug bounty hunter Adnan Khan provides strong evidence for the threats we outlined and their destructive outcomes. GitHub itself was found vulnerable, as well as various notable organizations, such as PyTorch, Tensorflow, Microsoft DeepSpeed, and Chia Networks.
What Is Software Attestation
In this blog series, we will uncover the details of SLSA provenance which refers to the ability to trust the authenticity of artifacts. SLSA (Supply chain Levels for Software Artifacts) is focused on protecting software from source through its deployment by allowing users to make automated decisions about the integrity of the artifacts they use, thereby preventing many possible attacks throughout the supply chain.
New Techniques Attackers Are Using to Harvest Your Secrets
Toyota Motor Corporation recently suffered a data breach due to a mistakenly exposed access key on GitHub. That hardcoded access key evaded detection for five years! This news joined a long line of headlines about the damage caused by hardcoding secrets in code and how it can lead to a full-blown software supply chain attack. When attackers manage to steal source code, the first thing they do is scan it for secrets to extend the impact of their breach.
Sophisticated 3CX Software Supply Chain Attack Affects Millions of Users
On March 29th, 2023, it was published that 3CX, the international VoIP IPBX software, was under an ongoing software supply chain attack. The attackers had trojanized the 3CX communication installer software, reportedly used by over 12 million users daily. Several endpoint security vendors, such as SentinelOne and CrowdStrike, identified this attack.
Legitify adds support for GitLab and GitHub Enterprise Server
We encounter security incidents on a weekly basis with prospective customers that involve pipeline manipulation, code theft, and sensitive data exposure - many of which result from bad source code management (SCM) system configurations. Legitify, the open-source security tool we recently announced, is rapidly gaining popularity because it helps users analyze and remediate the security configuration of their SCM resources.
Top Software Supply Chain Security Solution Approaches: Pros and Cons
What are different solution approaches to software supply chain security and what are the Pros and Cons for your organization? What is the modern definition of software supply chain security and why is it so important, now more than ever, to increase your focus on this aspect of cybersecurity? This blog will answer those questions and provide guidance to help support your decision to implement a solution. What Is a “Software Supply Chain”?
Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable
The Legit Security Research Team discovered a new class of software supply chain vulnerabilities that leverages artifact poisoning and attacks the underlying software development pipelines for projects using GitHub Actions. In this fourth blog covering vulnerable GitHub Actions, we will explore this new technique of artifact poisoning and describe who could be vulnerable, including how we found this vulnerability in the Rust programming language and assisted in its remediation.
Critical and Time Sensitive OpenSSL Vulnerability
OpenSSL has announced a fix in version 3.0.7 to be released Nov 1, 2022. It means that on Tuesday Nov 1 the race will start between those who patch and those who exploit. In this blog post, we'll summarize all the necessary information required to make sure you can win this race and keep your software supply chain risk-free.
Introducing Legitify: A Better Way To Secure GitHub
GitHub can be considered the “operating system” of many organization's development operation, and a single misuse can lead to critical incidents, data breaches and software supply chain attacks. It’s not about a lack of security features. GitHub can be configured to be fairly robust against a wide range of attacks. It has a wide range of security features and settings that enhance the safety of its users and organizations.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Roy
Contact Roy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack