Linux Kernel TIPC RCE, NPM Malware, OTP 2FA Bots, & Security Labels - ASW 173
This week in the AppSec News, Mike and John talk: Excel gains support for JavaScript data types and functions, arbitrary code execution in Linux kernel TIPC, more malware in npm packages, threat models and OTP/2FA bots, NIST Security Labels!
Time Stamps:
5:45 - Microsoft opens up Excel to custom data types with images, arrays, and more
9:21 - CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution
15:13 - Malware found in coa and rc, two npm packages with 23M weekly downloads
22:37 - The Booming Underground Market for Bots That Steal Your 2FA Codes
27:05 - HTTPS is easy, just turn it on…
30:34 - NIST unveils draft criteria for ‘seal of approval’ scheme on consumer software securit
35:51 - ‘Focus on brilliance at the basics’ – GitHub CSO Mike Hanley on shifting left and securing the software supply chain
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw173
#SecurityWeekly #ApplicationSecurity #SecurityNews #Cybersecurity #InformationSecurity