Paul’s Security Weekly (Video)
Technology
Sonar Vulnerability Researchers Thomas Chauchefoin and Paul Gerste conducted research on the security of Visual Studio Code — the most popular code editor out there — which was presented at DEF CON 31 in August. The pair uncovered a few ways for attackers to gain code execution on a victim's computer if they clicked on a specially crafted link or opened a malicious folder in Visual Studio Code, bypassing existing mitigations like Workspace Trust. Developers tend to trust their IDEs and do not expect such security issues to exist. As developers have access to source code and production systems, they make for very interesting targets for threat actors. Important to note is that the security concepts that the two are able to demonstrate apply not just to Visual Studio Code, but to most other code editors. This is also the story of how the researchers got an unexpected $30,000 bounty from Microsoft for these bugs, by mistake!
Segment Resources:
BLOG POSTS Securing Developer Tools: Argument Injection in Visual Studio Code (https://www.sonarsource.com/blog/securing-developer-tools-argument-injection-in-vscode/) Securing Developer Tools: Git Integrations (https://www.sonarsource.com/blog/securing-developer-tools-git-integrations/)
CVEs CVE-2023-36742 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742) CVE-2022-30129 (https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-30129) CVE-2021-43891 (https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-43891)
Show Notes: https://securityweekly.com/psw-804
ExpressLRS Protocol, Pi Pico W Wireless, Apple v. Spyware, & Lenovo UEFI Flaws - PSW #747
Six Degrees of BloodHound - Andy Robbins - PSW #747
Prank Calls, Lazarus APT, WordPress Critical Vulns, CISA Adds 41 Flaws, & Zoom Bugs - PSW #742
Building Career Links to Secure the Real Supply Chain - John Pescatore - PSW #742
Destructive Firmware, Keys to the Kingdom, the Device Level, & 5 CyberSec Myths - PSW #746
Cult of the Dead Cow & the Best Cybersecurity Journalism - Joseph Menn - PSW #746
Plastic Bags, NSA Playsets, Megs Insecure, PHP Strikes Back, & Gamification - PSW #745
Learning Should Be Fun - Sam Bowne - PSW #745
Big DDOS, Tracking Smartphones, BIOS Doom, NSO Buyer, & Android Children - PSW #744
We Help The Helpers; You Can Too! - Ray Davidson - PSW #744
Understanding WebApp Client-Side Security With Source Defense - Matt McGuirk - PSW #743
Charitable Ransomware, Year of Linux Malware, Follina MSDT, Twitter Fines, & Bounties - PSW #743
Windows GPU Display Vulns, NFT Discord Hack, Costa Rica Vs. Hackers, & Initial Access - PSW #741
Firmware Security - Saumil Shah - PSW #741
Year in Cyber Review 2021 - Robert Lee - PSW #741
Public Entities & Ransomware, Colonial Pipeline Fine, Nvidia's LHR Limiter, & BIG-IP - PSW #740
Destructive Malware & Other Threats to Watch - Fleming Shi - PSW #740
Lots of Star Wars, David Walden, Vulnerable Contractors, & Pirate Streaming - PSW #739
Risk Transfer With Engineering Based Cyber Insurance - Fatih Karayumak - PSW #739
Silk Road Seizure, Psychic Signatures, Twitter Algorithms, & Linux Desktops - PSW #738
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
Acquired