Welcome to another edition of NoFluffSecurity, the newsletter that cuts straight to the point—no hype, no fluff, just the cybersecurity insights you need. Whether you're a seasoned pro or new to the game, we’re here to help you stay ahead of threats and keep your clients, products, and services secure.

We don’t just serve up the facts; we dish out our unfiltered take on what’s happening in the industry. No sugar-coating, no scare tactics—just actionable advice that actually matters. What you do with it? That’s on you. But if you're here, you already know the stakes.

Before you enjoy this week’s dose of clarity, make sure to click that subscribe button if you haven’t already. You won’t want to miss our next issue!

Feature Story

Secure-by-Design – Building the Future of Software Engineering Education

Chris Wysopal, co-founder of the hacker group L0pht and a key advocate for secure-by-design principles, recently highlighted a critical gap in higher education: 23 out of 24 top U.S. computer science programs do not require courses in secure software design. Wysopal argues that the failure to teach secure-by-design from the start means that graduates are entering the workforce without the necessary mindset to proactively prevent vulnerabilities. Developers today are well-versed in performance optimization, functionality, and reliability, but security is still treated as an afterthought—something to be patched later, rather than built into the system from day one. This reactive model is not only expensive but leaves products vulnerable to attacks that could have been prevented.

Wysopal emphasizes that secure-by-design should be a core aspect of any software engineering curriculum. By embedding security early in the software development lifecycle, developers can significantly reduce the attack surface and create systems that are inherently more resilient. Drawing from his years of experience in vulnerability research and advocating for better security practices, Wysopal stresses that this educational gap leaves companies scrambling to patch issues that could have been avoided entirely with proper secure design practices in place.

NoFluff’s Take: Foundations First, AI Next—Navigating Secure Design in an AI-Driven World

Wysopal’s call to overhaul education hits the mark, but the future of secure design goes beyond just adding courses. As AI increasingly takes on tasks like vulnerability detection, developers will still need to master the basics to oversee and interpret AI outputs. While AI can automate many aspects of security, foundational knowledge in secure-by-design is critical. Without this groundwork, developers won’t have the skills to understand where AI might fall short, misinterpret vulnerabilities, or introduce false positives.

The challenge for educational institutions isn’t just about introducing secure design into curriculums but also preparing students for a hybrid world where AI does much of the legwork. Developers of the future will need to know how to think critically about security, even if AI is helping automate much of the process. By focusing first on secure design principles and then layering on AI-driven tools, we ensure that developers have the skills needed to adapt to the evolving tech landscape.

Secure-by-design must become a core property of software engineering, not just a feature of cybersecurity. It’s not just about avoiding vulnerabilities, but about creating robust systems that are built to withstand both human and AI-assisted attacks. Teaching secure design as an integral part of quality software is what will ultimately elevate both individual developers and the industry as a whole.

#SecureByDesign #SoftwareEngineering #CybersecurityEducation #L0pht #AIinCybersecurity

References

1. Forbes: Why Higher Education Should Prioritize Teaching Secure-By-Design

Breaking News

Perfctl Malware Exploiting Linux Misconfigurations Since 2021

The Perfctl malware, which has been active since 2021, has silently infected thousands of Linux systems by exploiting over 20,000 common misconfigurations. It gains persistence by leveraging weaknesses in performance monitoring tools and critical vulnerabilities such as CVE-2023-33246 in Apache RocketMQ. The malware also conceals its activities using rootkits, allowing attackers to maintain remote access for cryptocurrency mining and proxy-jacking. This highlights the need for organizations to focus on configuration management and proactive security monitoring in Linux environments.

NoFluff's Take: Misconfigurations – The Quiet Killer

Perfctl reminds us that advanced malware doesn't always rely on flashy zero-days—often, it exploits the basics. The ability of Perfctl to leverage thousands of common Linux misconfigurations signals that many organizations overlook proper configuration management. This is a wake-up call for organizations that assume security is only about patching vulnerabilities. Hardening configurations is equally critical to closing off attack surfaces that malware can exploit. Security must be built into the system’s core configurations, focusing on reducing risk from the design phase onward.

CISO Takeaways

• Automated Configuration Audits: Automate regular configuration audits and flag common misconfigurations across Linux systems which can identify potential vulnerabilities before malware like Perfctl can exploit them.

• Zero-Trust Microsegmentation: Implement microsegmentation to isolate workloads and limit lateral movement within the network. If one system is compromised, the malware cannot easily spread to other systems within the organization.

• Focus on Vulnerability Management Beyond Patching: While patching vulnerabilities is critical, CISO strategies should expand to include comprehensive configuration management. Ensuring that Linux systems are properly configured can prevent Perfctl from gaining access in the first place, minimizing the risk of rootkit installation.

Security Engineer Thoughts

• Automated OS Configuration Auditing: Utilize tools like Lynis or OpenSCAP to audit your Linux systems for common misconfigurations that could be exploited by malware like Perfctl. These tools are designed to scan for misconfigurations in the operating system itself, ensuring that critical services and permissions are correctly set to minimize vulnerabilities.

• Implement Runtime Detection: Consider using tools like Wazuh and Falco for real-time detection of abnormal behavior. Wazuh offers host-based intrusion detection, file integrity monitoring, and configuration assessments, making it ideal for spotting unauthorized system changes or misconfigurations that Perfctl could exploit. Meanwhile, Falco specializes in real-time anomaly detection by monitoring system calls and identifying unusual activity, especially in containerized or cloud-native environments. Both tools provide critical visibility into runtime behavior, helping to catch suspicious activity early.

• Harden Service Configurations: Focus on hardening system-level services, especially those related to performance monitoring tools that Perfctl is known to exploit. This includes limiting which services have access to root privileges and ensuring that unnecessary services are disabled or properly sandboxed.

#LinuxSecurity #PerfctlMalware #ConfigurationManagement #Rootkits

References

Soylent, Ars Technica: Thousands of Linux systems infected by stealthy malware since 2021

Latest Research

When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying

A new report highlights how compromised cloud credentials are fueling the abuse of AI models, specifically for illicit purposes like sex bots and inappropriate role-playing services. In this case, hackers seized exposed Amazon Web Services (AWS) credentials to access Amazon Bedrock’s AI capabilities, creating AI-powered sex bots by bypassing content filters. Security researchers at Permiso found that hackers were using techniques to "jailbreak" the AI models, allowing them to ignore built-in safety mechanisms and produce responses typically restricted by the models. Over 75,000 model invocations were detected within just two days, most involving sexually explicit content, illustrating the danger of misused cloud infrastructure combined with AI tools and how rapidly these attacks can escalate once access is gained.

NoFluff's Take: The Same Story, New Weapon

At its core, this is yet another case of credential theft and cloud service abuse. The twist this time is the use of AI models, which are being jailbroken to sidestep ethical and content restrictions. What makes this different isn’t the method—it’s the impact. AI models, particularly in cloud environments like AWS, provide immense power that can be misused in disturbing ways when left unsecured. The security weaknesses—exposed credentials, lack of logging, and improper permissions—are familiar themes in cloud security incidents. What’s new is the creative and harmful exploitation of AI services, a reminder that advanced tools in the wrong hands can result in ethically questionable outcomes. The takeaway here isn’t just about AI or cloud misconfiguration—it’s the growing trend of turning technological power into socially harmful tools.

CISO Takeaways

1. Enforce Strong Cloud Security Practices: Disable long-term access keys and rotate credentials frequently. Implement multi-factor authentication (MFA) and least-privilege access control to minimize risks from credential exposure.

2. Ensure Cloud Logging and Monitoring: Turn on logging by default in cloud environments to track AI model usage and unusual behaviors. AWS CloudTrail, for example, can help spot misuse early.

3. Integrate AI-Specific Security Controls: Build AI governance frameworks that include controls for detecting and preventing jailbreaking techniques, ensuring that models operate within ethical guidelines.

Security Engineer Thoughts

1. Automate Credential Management: Use tools like AWS IAM Access Analyzer to automatically rotate keys, enforce short-lived credentials, and detect misconfigurations that could lead to credential exposure.

2. Enable AI Monitoring: Implement continuous monitoring of AI model invocations to identify and prevent content that violates the model’s safety restrictions. Use AWS GuardDuty and AWS Config for ongoing checks.

3. Secure API Access: Restrict API access for AI models to only necessary components, limiting the surface area that an attacker can exploit through stolen credentials.

#CloudSecurity #CredentialTheft #AIJailbreak #AIAbuse

References

1. https://krebsonsecurity.com/2024/10/a-single-cloud-compromise-can-feed-an-army-of-ai-sex-bots/

2. https://permiso.io/blog/exploiting-hosted-models
   

Tools

Chainguard: Securing the Software Supply Chain with Hardened Tools

Chainguard provides a suite of tools designed to address the growing need for securing the software supply chain. It focuses on ensuring the integrity and security of every component used in modern development pipelines, with particular emphasis on containerized environments. Chainguard's core offering revolves around hardened base images, like Wolfi, built to be minimal, verifiable, and compliant with modern supply chain security standards. These images are tailored for environments where reducing the attack surface is critical, allowing DevSecOps teams to minimize the risk posed by third-party dependencies while optimizing for performance and security.

Chainguard stands out by automating essential security tasks such as signing, provenance verification, and Software Bill of Materials (SBOM) generation, which helps organizations meet compliance requirements while streamlining their pipelines. This approach is particularly suited for enterprises embracing cloud-native and Kubernetes-based architectures, where trust and security in containers are paramount.

NoFluff's Take: The Challenge of Seamless Integration

Chainguard offers significant advantages in ensuring supply chain security, but like many tools in the DevSecOps landscape, integrating it seamlessly into existing workflows presents its own challenges. While automation can handle many routine tasks like signing and verifying, Chainguard’s reliance on hardened, minimal images may cause friction with developers accustomed to more flexible, full-featured base images. Organizations may face challenges with performance trade-offs when using smaller, more secure images, and there could be compatibility issues in more complex, multi-cloud environments. Additionally, as with any powerful security tool, effective use requires clear understanding and proper configuration, which can stretch teams unfamiliar with advanced security concepts.

Chainguard shines in automating supply chain security for modern DevOps, but organizations should be prepared to invest time in training and documentation to ensure the tool is properly integrated without slowing down development cycles. Security automation is essential, but it's not a set-it-and-forget-it solution; careful oversight and understanding of its limitations are key to maximizing its benefits.

Developers can get started with Chainguard for free by accessing their public catalog of secure, minimal container images. You can explore and use these images directly at: https://images.chainguard.dev/.

CISO Takeaways

• Integration Planning: Ensure a detailed plan for integrating Chainguard into existing CI/CD workflows. Teams should test the impact on performance and compatibility with existing toolsets.

• Automated Compliance: Leverage Chainguard’s ability to generate SBOMs and ensure all artifacts meet security and compliance requirements, especially for highly regulated environments.

• Continuous Monitoring: Even with automated checks, CISOs must ensure that Chainguard’s configurations align with the organization's security policies and perform regular audits.

Security Engineer Thoughts

• Minimize Attack Surface: Use Chainguard’s minimal images to drastically reduce unnecessary software, shrinking the attack surface and making it harder for vulnerabilities to creep in.

• Focus on Compatibility: Test Chainguard’s hardened images in your environments to ensure compatibility with your existing stack, particularly if you rely on certain libraries or frameworks that might not be included in the minimal images.

• Expand Automation: Pair Chainguard with continuous integration tools to automatically scan dependencies and catch issues early in the development lifecycle, before they can become larger security concerns.

#supplychainsecurity, #containers, #opensource, #AI

References

1. https://www.chainguard.dev

If you’re not already one of our regulars then that Subscribe button below has your name on it ;) See you next week!

All views and opinions expressed therein are solely the authors’ own and do not reflect those of any employers past or present.

NoFluffSec is a Bitsavant LLC publication