Newsletter
02.15.2022 | 5'' read
Finally, some refreshing security news…
The best things I read this week.
The second best was news from Google Project Zero that vendors are getting better — and faster — at fixing high-risk security vulnerabilities.
TL/DR:
- In 2021, vendors took an average of 52 days to fix security vulnerabilities reported from Project Zero. This is a significant acceleration from an average of about 80 days 3 years ago.
- In addition to the average now being well below the 90-day deadline, GPZ also saw a dropoff in vendors missing the deadline (or the additional 14-day grace period). In 2021, only one bug exceeded its fix deadline, though 14% of bugs required the grace period.
And the worst…
The worst thing on the entire Internet this week was the endless list of companies buying nonsense fake “cybersecurity excellence awards.” Proofpoint even put out a press release to boast they “won” 35 of these dumb logos. Some company called Irdeto won 23 awards, including the bizarrely named “best cybersecurity company.” Make it stop, please.
The second worse is the realization there’s no respite from in-the-wild zero-day attacks this year. Since we last spoke, Apple shipped an out-of-band patch for an “actively exploited” WebKit/iOS zero-day and Google followed suit a few days later with patches for an under-attack Android flaw. Oh, Adobe too.
For those counting, we’ve discovered six (6) zero-days so far this year and it’s only the middle of February.
As usual, reboot those iPhones.
_ryan
- Join us on Wednesday, February 23 for SecurityWeek’s Attack Surface Management Summit, presented by Randori. Learn from experienced CISOs, cloud software engineers, network architects, and security response engineers about best practices, defense frameworks and actionable data and to reduce risk from exposed attack surfaces. Registration is open.
Podcast comin’.
I’m thrilled to welcome a few new faces (and episodes) to the podcast. Look out for long-form conversations with these folks in the coming weeks:
- OG hacker and security researcher Chris Rohlf (currently at Facebook).
- Netskope CISO Lamont Orange.
- Pwn2Own co-founder Aaron Portnoy (currently working on exploitation at Randori).
- The return of Thinkst’s Haroon Meer (listen to previous episode).
- Chainguard CEO Dan Lorenc on securing software supply chains.
News headlines.
- Rapid7 is running into some regulatory hiccups with its research data sharing programs.
- VMWare has finally patched those nasty Tianfu Cup zero days.
- New data from GPZ shows that almost all the big vendors are patching security flaws faster than the 90-day deadline.
- Google’s new Chrome OS Flex is being pitched as a ransomware recovery option.
Supply chain security.
- GitBOM is a new supply chain security tool. It’s a Cisco-backed project with a whitepaper written by a Microsoft engineer.
- VC investors starting to pour money into startups with supply chain security ambitions.
- John Speed Meyers makes a case for farm-to-table package signing.
- Guillaume Ross shares notes on applying BYOD to sooth supply chain pain.
- Matt Bryant (a former colleague of mine at Bishop Fox) finds a unique way to compromise popular NPM packages by targeting expired domain names.
Sponsored.
- Using Symmetry DataGuard, cloud-security teams tighten IAM policies around data, incident response teams know precisely what data objects are involved in a breach, and governance teams audit every access across every data store. Schedule a demo.
Must-see research projects.
- SentinelLabs documents ModifiedElephant, an India-linked APT group that used malware to plant evidence on activists’ phones. See this WaPo article with more details.
- Proofpoint researchers Selena Larson and Joe Wise document a threat actor targeting the aviation, aerospace, transportation, manufacturing and defense industries since 2017.
- PortSwigger’s top-10 web hacking techniques for 2021 is out and the top spot goes to Alex Birsan’s work on dependency confusion.
- NYTimes journalist Kashmir Hill used Apple AirTags and the vast location-tracking network around us in an experiment to track her husband’s every movement. (Non-paywall archive).
- The Mercari engineering team shares how they defend against novel threats.
Ransomware money laundering.
- Chainalysis shares fresh data on the ransomware wealth transfer from U.S. companies to Russian cybercriminal gangs.
- Andy Greenberg looks at the $3.6 billion bitcoin seizure and discusses just how difficult it is to launder crypto. (Non-paywall archive)
- The FBI has an important advisory with IOCs to help mitigate damage from the BlackByte ransomware-as-a-service group.
Essays.
- Maya Kaczorowski: BeyondCorp is dead, long live BeyondCorp.
- From bug bounty hunter to working on security at Microsoft
- There are no major surprises in Vasu Jakkal’s piece on CISO’s top priorities heading into 2022.
- Andy Ellis documents his disdain for vulnerability metrics reporting.
- Samuel Greengard wonders whether biology could hold the clue to better cybersecurity decisions.
- Guillaume Ross shares notes on applying BYOD to sooth supply chain pain.
- Podcast: Chris Eng and Dennis Fisher on Veracode’s State of Software Security report.
Tangentially.
- The new hire who showed up is not the same person we interviewed. <– I’ve heard of this happening at quite a few prominent cybersecurity programs.