Security Weekly
Application Security WeeklySubscribe
Application security, Threat Management, Vulnerability Management

Semgrep, Microsoft Signs With Rootkits, ATT&CK/D3FEND, & Injured Android – ASW #156

This week in the AppSec News: Visual Studio Code's Workplace Trust, Injured Android an insecure mobile app, Microsoft accidentally signed driver with rootkits, The NSA funds a new sister Matrix to ATT&CK: D3FEND, & "Ransomware: maybe it's you, not them?", and more!

Full episode and show notes

Announcements

  • Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!

Hosts

Adrian Sanabria
Adrian Sanabria
Director of Product Marketing at Valence Security
  1. 1. D3FEND Matrix
  2. 2. Semgrep: The Surgical Static Analysis Tool
  3. 3. InjuredAndroid – CTF
  4. 4. I know what I didn’t do last summer!
  5. 5. Lightning Components: A treatise on Apex Security from an External Perspective – AppOmni %
  6. 6. The Fault in Our Stars
John Kinsella
John Kinsella
Co-founder & CTO at Cysense
  1. 1. Visual Studio Code’s Workplace Trust
    The May release of Visual Studio Code added something called Workspace Trust - what looks like a significant improvement in the safety for browsing code from within VSCode. Functionality includes being able to prevent code execution from running Tasks, debugging, workplace settings, or extensions. Looks like they have these features for either workplace or folder granularity.
  2. 2. Microsoft accidentally signed driver with rootkits
    Microsoft signed a signature request from a vendor that contained malicious software, without either the vendors or Microsoft's awareness. While Microsoft as since signed a clean version, the question is how did this get signed in the first place?
  3. 3. Ransomware isn’t out of control – security teams are
    Here's a think piece for us to...think about what we want and expect our security teams to do. While in any environment we need everybody to work on security together, security teams and management must set the direction and goals for us. With that guidance - how can we better prevent security issues, whether they're ransomware or others?
  4. 4. What are the odds someone will find and exploit this?
    Up to 80% of developers are releasing software with some known vulnerability. How can we improve that stat?

Related

All the News — Just Six Months Later – ASW #265

We cover appsec news on a weekly basis, but sometimes that news is merely about the start of a new project, sometimes it's yet another example of a vuln class, and sometimes it's a topic we hope doesn't become a trend. So, what themes have we seen and where do we see them going? Here are a few headline topics that have alternately generated yays a...