The Last Watchdog

JUNE 3, 2022

Log4J, aka Log4Shell, refers to a gaping vulnerability that exists in an open-source logging library that’s deeply embedded within servers and applications all across the public Internet. Its function is to record events in a log for a system administrator to review and act upon. I’ll keep watch and keep reporting.

Systems administration 255

Systems administration Libraries Risk Authentication 255

The Last Watchdog

MARCH 29, 2022

These were all obscure open-source components that, over time, became deeply embedded in enterprise systems across the breadth of the Internet, only to have a gaping vulnerability discovered in them late in the game. Log4j, for instance, is a ubiquitous logging library. I’ll keep watch and keep reporting.

Security 223

Security Cloud Digital transformation Cybersecurity 223

The Last Watchdog

MARCH 4, 2019

For instance, major vulnerability was discovered lurking in the GNU C Library, or GLIBC, an open source component that runs deep inside of Linux operating systems used widely in enterprise settings. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

Energy and Utilities 212

Energy and Utilities Systems administration Access Cybersecurity 212

ForAllSecure

AUGUST 16, 2019

And it uses heuristics to pick those inputs, and one of the things we built is a way to monitor that application as it runs and to inform the fuzzer on how to come up with new inputs that would get different behaviors. You have software component analysis, which looks for known vulnerable versions of libraries and other things, right?

Marketing 52

Marketing Government IT Systems administration 52

ForAllSecure

AUGUST 16, 2019

And it uses heuristics to pick those inputs, and one of the things we built is a way to monitor that application as it runs and to inform the fuzzer on how to come up with new inputs that would get different behaviors. You have software component analysis, which looks for known vulnerable versions of libraries and other things, right?

Marketing 40

Marketing Government IT Systems administration 40

ForAllSecure

AUGUST 16, 2019

And it uses heuristics to pick those inputs, and one of the things we built is a way to monitor that application as it runs and to inform the fuzzer on how to come up with new inputs that would get different behaviors. You have software component analysis, which looks for known vulnerable versions of libraries and other things, right?

Marketing 40

Marketing Government IT Systems administration 40

ForAllSecure

OCTOBER 30, 2019

TwistLock, Anchore) check built docker image for out-of-date, vulnerable libraries. Despite the fact that fuzzers autonomously generates inputs that triggers bugs, shedding light on where to locate the bug and how to trigger it, researchers still opt not to report their findings. For example: Software Component Analysis tools (e.g.,

Security 52

Security Cybersecurity Systems administration IT 52