BINARLY

National Institute of Standards and Technology (NIST) has recently reaffirmed priority for transitioning to post-quantum cryptography. In November, we received the dates for the retirement of RSA and ECC algorithms in the post-quantum era: deprecated in 2030 and disallowed in 2035 (source: https://lnkd.in/gPDwn_UG). This transition raises numerous questions about how it will unfold. We are witnessing numerous ongoing discussions on this topic. However, one critical aspect that requires immediate attention is the accurate inventory of cryptographic materials and the identification of potentially vulnerable/risky ones. At BINARLY, we are constantly ahead of the curve. Our Transparency Platform not only provides insights into cryptographic materials but also validates them in the code, enabling reachability analysis and helping you prioritize critical discoveries.

Recently, one of our customers asked if our BINARLY Transparency Platform supports signature validation for ELF-signed binaries. At the moment, we don’t support this feature primarily because we haven't identified the problem from the customer’s perspective. They needed to check if the signature was present at all on a large set of ELF files and embedded certificates and if it was expired or no longer useful. We accepted the challenge and delivered the new feature within a week (Thanks, REsearch team!). However, I was delving deeper into the problem. The primary issue with signed ELF files is the lack of a formal standard or specification detailing how signed files should be structured and validated, something similar to MS Authenticode. The only tool available for signing ELF files is signelf, which has been outdated since 2004 and poses security risks. signelf was initially used in Sun Solaris back in the early 2000s when they implemented an early Verified Boot scheme (a part of SPARC history). Surprisingly, there’s no consistency in this regard, and even now, Linux doesn't provide a clear direction for signatures on standalone binaries. Some individuals will argue that we don’t need to sign standalone components like ELF files when the entire package, such as RPM/DEB, could be signed and validated. While signatures are useful in bootloaders and embedded firmware, they also contribute to software supply chain consistency by providing more traceable evidence of origin (if certificates aren’t leaked or stolen). I may write a separate blog post to explore these thoughts in more detail.

It’s surprising and disheartening to see that, in 2023, the top exploited vulnerabilities still include security issues that should have been eradicated by now. Many network appliances rely on legacy codebases, riddled with ancient vulnerabilities like code and command injections or a lack of input validation. It's clear that all the existing code analysis tools are either not up to the scale of these problems or are simply useless.

Is AI more useful for attackers or defenders? #TechWeek #softwaresupplychainsecurity

Thank you Alex Matrosov, CEO and Founder of BINARLY, for delivering a tour de force lecture on modern software supply chain risks at Alperovitch Institute for Cybersecurity Studies at Johns Hopkins School of Advanced International Studies (SAIS), moderated by our Managing Director Dr. Elly R.. ?? Johns Hopkins University Bloomberg Center

Great to hear the Three Buddy Problem podcast discussing software and hardware inspectability and including BINARLY tech as a great example of a solution bringing transparency to the software supply chain. Ryan Naraine Costin Raiu

Cris Neckar, Partner at Two Bear Capital, highlights a critical blind spot in our understanding of the ingredients of modern software supply chains. He calls attention to a risky world where everyday items like cars contain multiple embedded computers running opaque software systems. #IoTsecurity #softwaresupplychain #softwaredefinedcars #TechWeek

??"Why is the complexity of modern software creating huge gaps in the #SoftwareSupplyChain?" -- Ryan Naraine #LATechWeek

Thanks to all who attended our #LATechWeek panel exploring early-stage growth on today’s dynamic tech scene.?Our panel featured Michael Goguen and Cris Neckar from Two Bear Capital; representatives from our portfolio -- Alex Matrosov from BINARLY and Gregory Kurtzer from CIQ; along with Andrew Case from Volexity and Ryan Naraine from Security Conversations. The perspectives shared on vulnerability of supply chains, challenges of reliable data sets for AI and bad acting nation states were insightful. Moreover, the opportunity to meet and share ideas with the founders and innovators in the space in attendance was invaluable. #TwoBearCapital #CIQ #Binarly #LATechWeek

Thanks for having us on the show Viktor Petersson