François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages

The Application Security Podcast

Indhold leveret af Chris Romeo and Robert Hurlbut, Chris Romeo, and Robert Hurlbut. Alt podcastindhold inklusive episoder, grafik og podcastbeskrivelser uploades og leveres direkte af Chris Romeo and Robert Hurlbut, Chris Romeo, and Robert Hurlbut eller deres podcastplatformspartner. Hvis du mener, at nogen bruger dit ophavsretligt beskyttede værk uden din tilladelse, kan du følge processen beskrevet her https://da.player.fm/legal.

1y ago 45:31

MP3•Episode hjem

François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain. To help address this, his team developed an open source scanner called Poutine that can identify vulnerable build pipelines at scale and provide remediation guidance. Francois has over 10 years of experience in building application security programs, he’s also the founder of the NorthSec conference in Montreal.
Mentioned in the Episode:
Cooking for Geeks by Jeff Potter
Poutine
Living Off the Pipeline project
Grand Theft Actions Abusing Self Hosted GitHub Runners - Adnan Khan and John Stawinski

Where to find Francois:
LinkedIn
X: @francoisproulx

Previous Episodes:
François Proulx -- Actionable Software Supply Chain Security

FOLLOW OUR SOCIAL MEDIA:

➜Twitter: @AppSecPodcast
➜LinkedIn: The Application Security Podcast
➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast

Thanks for Listening!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

320 episoder

#Robert Hurlbut #Security #Tech #Software Development #Application Security #Threat Modeling #Security Culture #News #Tech News #Podcasting Education #pChris Romeo And Robert Hurlbut #pChris Romeo #OWASP #DevSecOps #DevOps