News

Veracode’s 2023 State of Software Security Report is focused on flaw introduction

Microsoft’s January Patch Tuesday resolved over 100 CVEs, including an actively exploited zero day

WhatsApp can now sue for damages ensued by the installation of the Pegasus spyware

An attacker could perform RCE on a server verifying a maliciously crafted JWT request

Called “default setup,” the novel capability simplifies starting code scanning on repositories

The NCSC’s new Funded Cyber Essentials Programme will support SMEs as well as charities

A Ukrainian official revealed that evidence of Russian cyber-attacks are being gathered to support potential war crime prosecutions

Get ’em while they’re hot. And get ’em for the very last time, if you still have Windows 7 or 8.1…

It’s remotely triggerable, but attackers would already have pretty deep network access if they could “prime” your server for compromise.

I don’t know how much of a thing this will end up being, but we are seeing ChatGPT-written malware in the wild.

…within a few weeks of ChatGPT going live, participants in cybercrime forums—­some with little or no coding experience­—were using it to write software and emails that could be used for espionage, ransomware, malicious spam, and other malicious tasks.

“It’s still too early to decide whether or not ChatGPT capabilities will become the new favorite tool for participants in the Dark Web,” company researchers wrote. “However, the cybercriminal community has already shown significant interest and are jumping into this latest trend to generate malicious code.”

Last month, one forum participant posted what they claimed was the first script they had written and credited the AI chatbot with providing a “nice [helping] hand to finish the script with a nice scope.”

The Python code combined various cryptographic functions, including code signing, encryption, and decryption. One part of the script generated a key using elliptic curve cryptography and the curve ed25519 for signing files. Another part used a hard-coded password to encrypt system files using the Blowfish and Twofish algorithms. A third used RSA keys and digital signatures, message signing, and the blake2 hash function to compare various files.

Check Point Research report.

ChatGPT-generated code isn’t that good, but it’s a start. And the technology will only get better. Where it matters here is that it gives less skilled hackers—script kiddies—new capabilities.