Author Archives: Nathan Aw

Software Supply Chain Security – blockchain and smart contract to build workflows to sign, verify and protect software artifacts for true provenance? [closed]

Posted on by

I refer to https://github.com/nathanawmk/using-blockchain-to-establish-software-provenance-thereby-securing-open-source-software-supply-chain
Will the use of blockchain and smart contract to build workflows to sign, verify and protect soft… Continue reading Software Supply Chain Security – blockchain and smart contract to build workflows to sign, verify and protect software artifacts for true provenance? [closed]→

Software Supply Chain Security – blockchain and smart contract to build workflows to sign, verify and protect software artifacts for true provenance? [closed]

Posted on by

I refer to https://github.com/nathanawmk/using-blockchain-to-establish-software-provenance-thereby-securing-open-source-software-supply-chain
Will the use of blockchain and smart contract to build workflows to sign, verify and protect soft… Continue reading Software Supply Chain Security – blockchain and smart contract to build workflows to sign, verify and protect software artifacts for true provenance? [closed]→

supply chain security – ways of detecting and deterring compromise at a lower level i.e., hardware class of vulnerabilities [duplicate]

Posted on by

Software supply chain focuses on software. How about hardware supply chain security? I refer to Compromise Hardware Supply Chain ("https://attack.mitre.org/techniques/T1195/003/").
I wish to know how can one detect if one’s hardw… Continue reading supply chain security – ways of detecting and deterring compromise at a lower level i.e., hardware class of vulnerabilities [duplicate]→

Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication?

Posted on by

Given the increasing widespread adoption of Time-based one-time password (TOTP) in view of SMS OTP hacks, Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication, on top of username/password?
I refer … Continue reading Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication?→

In view of the recent open source security incidents, does "Security through Obscurity" represent a new way forward? [closed]

Posted on by

With the recent spate of open source software incidents (log4shell, npm hacks), I return to the timeless 1984 turing lecture by ken thompson on trusting trust – https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrusting… Continue reading In view of the recent open source security incidents, does "Security through Obscurity" represent a new way forward? [closed]→

How did Alibaba Cloud Security Team engineer discover the log4j vulnerability? Reverse Engineering, Fuzzing, both or?

Posted on by

How did the Alibaba Cloud Security Team engineer discover the Log4Shell (CVE-2021-44228) vulnerability? What was the detailed account of the discovery and/or the events leading up to the discovery?
More importantly, what are the techniques… Continue reading How did Alibaba Cloud Security Team engineer discover the log4j vulnerability? Reverse Engineering, Fuzzing, both or?→

Applying Cleanroom Engineering Techniques such as Formal Verification/Formal Specifications to root out 0-day vulnerabilities such as log4shell? [closed]

Posted on by

I refer to Cleanroom Software Engineering Reference Model (https://kilthub.cmu.edu/articles/journal_contribution/Cleanroom_Software_Engineering_Reference/6572228) and Zero-Defect Software (https://trace.tennessee.edu/cgi/viewcontent.cgi?ar… Continue reading Applying Cleanroom Engineering Techniques such as Formal Verification/Formal Specifications to root out 0-day vulnerabilities such as log4shell? [closed]→

Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?

Posted on by

Does Log4Shell ("CVE-2021-44228") affect K8S/Containers and/or function-as-a-service (FaaS) running image with affected log4j?
I would like to understand if this vulnerability affects ephemeral setups such as K8S/FaaS and how JND… Continue reading Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?→