Risks Associated With That Software You Just Downloaded
How a VS code extension, your music software, third party code, MCP servers, and your AI generated code can lead to a major data breach
This is part of my blog series on Secure Code By Design .
Vulnerabilities and malware flying under the radar
I remember coming to a new company to help them migrate to the cloud as a cloud architect and later Directory of SaaS Engineering. I reviewed their existing code base before migrating an on-premises solution to the cloud and noticed some interesting open-source libraries. One was very old and looked like it hadn’t been updated in years. It was from some no-name developer, and who knows what was in it. That was in a firewall product. Perhaps the code was reviewed line for line and completely safe, but based on other experiences, likely not.
As a software professional, how do you select the third-party software you choose to use? Do you pull it off the Internet and stick it in your codebase as-is when you find something that does the job? Do you have auto-update turned on with no review, scanning, or testing when that code enters your code repository? Do you know what all those lines of code are doing? Do you monitor network traffic and system behavior after you start using it? Do you update the software regularly and only from legitimate sources? Is it even supported? Do you know who wrote it, who can update it, and how?
Are security vulnerabilities being patched? Or are people even reporting security vulnerabilities because if there’s no incentive to do so (no bug bounty) why would they? The people who do security research need to make a living and pay bills. They are going to focus on who pays and treats them well. Why are people all aghast when 17 year old bugs are found in open source software that “no one ever found in all that time.” Did anyone even look? Why would they?
Guess what. Now that we are using AI-generated code you have a whole lot more code to review. All that code is essentially the equivalent of third party software you need to review before incorporating it into your software. Although AI is pretty good at writing code it can randomly make mistakes. Models can be poisoned. Injection attacks can affect the output. You have to treat it like potentially insecure, risky, open source software and take appropriate measures to secure it.
Read the rest of the post here:
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article