Chris Wysopal

Chris Wysopal, co-founder and CTO of Veracode, is recognized as an expert and a well-known speaker in the information security field. He has given keynotes at computer security events and has testified on Capitol Hill on the subjects of government computer security and how vulnerabilities are discovered in software. His opinions on Internet security are highly sought after and most major print and media outlets have featured stories on Mr. Wysopal and his work. At Veracode, Mr. Wysopal is responsible for the security analysis capabilities of Veracode technology.
Posts by Chris Wysopal

Web-based threats finally getting the respect they deserve?

April 23, 2013  | Research

The recently released Microsoft Security Intelligence Report shows that web-based propagation vectors have surpassed traditional malware propagation vectors as the largest threats to distributed network environments. While I agree with Microsoft’s assessment of the threat landscape, I don’t think this is anything new; it is just the current state of a long-running trend. Back in 2008... READ MORE

Stolen Data Headers from the Federal Reserve Hack

February 6, 2013  | Research 8

Just another day at the office. Anonymous hacked into a Federal Reserve computer. Wait, what? Don’t worry, the attackers did not make off with any money, as far as we can tell, or disrupt any critical functions. What did they get? Just the details of 4000 bank executives. The data has been posted to pastebin and hosted on several compromised sites including other government sites. Someone... READ MORE

Security Debt and Vulnerability Supply Chains

November 16, 2012

When we were kicking around ideas for a new SoSS supplement, I thought the vendor testing angle could be interesting. We had just launched our VAST program so the topic made our marketing folks happy, but also because I think the supply chain analogy can be an interesting lens to view the security industry. We can think about the software supply chain as the vulnerability supply chain. In a sense... READ MORE

Never Attribute to Malice, but Always Verify

October 15, 2012

When I read the New York Time BITS article “The Dangers of Allowing an Adversary Access to a Network” by John Markoff, I thought the fear of trojaned vendor products is misplaced. The much bigger problem is vulnerable products. To cyber security experts, a serious vulnerability is indistinguishable from a backdoor as both allow an adversary to take control of a system or device. Yet the U.S.... READ MORE

Moving From Poisoning the Ocean to Poisoning the Watering Hole

September 26, 2012

RSA has published, "THE VOHO CAMPAIGN: AN IN DEPTH ANALYSIS" which describes an APT style campaign against several targets. The campaign used malicious content on several websites dubbed "watering holes" in order to compromise the campaign target's client machines. Injecting malicious content into vulnerable websites that will then become a drive-by client attack to a website visitor is old news... READ MORE

Announcing New eBook - Mobile Security For The Rest Of Us

June 11, 2012

document.write(unescape("%3Ca href='mailto:?subject=" + document.title + "&body=" + document.URL + "' style='width: 22px;'%3E%3C/a%3E")); document.write(unescape("%3Ca href='" + document.URL + "' target='_blank' style='width: 22px;'%3E%3C/a%3E")); document.write(unescape("%3Ca href=" + document.URL + "... READ MORE

Verizon Data Breach Investigative Report 2012 -- Application Security Specific Highlights

March 22, 2012

Verizon just released its 2012 Data Breach Investigative Report which contains findings contributed by global agencies such as the U.S. Secret Service, the Dutch High Tech Crime Unit, the Irish Reporting and Information Service, the Australian Federal Police and the London Metropolitan Police. I thought it would be good to put together a quick summary covering application security specific... READ MORE

Demystifying Binary Static Analysis

March 12, 2012

Last Wednesday I was honored to be able to present a talk on Binary Static Analysis to an Intro to Security class at Tufts University. The instructor, Ming Chow, approached me to speak to his class as he likes to bring in security practioners who are delivering security to their customers. There does seem to be some mystery still to static binary analysis even though Veracode has been delivering... READ MORE

FBI Gets Bitten by Operational Security

February 7, 2012

At corporations and government offices around the world a security failure happens every day. Employees forward confidential calendar events and messages to personal calendars and personal email accounts. This may make their jobs easier but it can put their companies at risk. A recent security incident involving the FBI can teach us something about corporate security. Excerpts in italics from... READ MORE

ICS-CERT Warns of Backdoors in Standard Network Module

December 14, 2011

ICS-CERT warns of backdoors in a standard network module for control systems. The type of equipment is the Schneider Electric Quantum Ethernet Module. Both static passwords and a remotely accessible debug service were found. Backdoors in industrial control systems These backdoor revelations in industrial control equipment are becoming frequent. Earlier this year Dillion Beresford found similar... READ MORE

Love to learn about Application Security?

Get all the latest news, tips and articles delivered right to your inbox.




contact menu