Security @ Google. Previously co-founder of @ForAllSecure. Opinions here are my own. @ayper@infosec.exchange
Pittsburgh
Joined August 2008
- Tweets119
- Following677
- Followers517
- Likes435
Alex Rebert retweeted
Can we translate all C to Rust? The susceptibility of C to memory corruption has long been a cybersecurity pain point, and coding agents can free us of it. Read on for my recent experiments in this space, and apt & docker repos that you can pull rust-converted libraries from!
Alex Rebert retweeted
Hardening the C++ Standard Library at massive scale. A look at increasing memory safety with libc++ hardening — a collaborative paper from engineers at Apple and Google. The results have been impressive: at Google the team discovered and fixed 1000+ bugs as hardening was enabled. queue.acm.org/detail.cfm?id=…
Alex Rebert retweeted
🛡️Want to help make the open source world safer and earn up to $45k 💰?
We've revamped our Patch Rewards Program, extending its scope and increasing rewards for security patches – with a particular focus on memory safety, including bonus multipliers!
bughunters.google.com/blog/5…
Alex Rebert retweeted
Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲
Discover how Google's security teams turn employee farewells into security tests.
bughunters.google.com/blog/6…
Alex Rebert retweeted
Bounds-checking in C++: so people ask if the .3% overhead is real. It's not just a benchmark result, we got this through our Google-Wide profiling, that gives us the live insights from DCs. This surprised us too as it was much cheaper than we thought
research.google/pubs/google-…
Excited to share our latest post on memory safety! We're tackling spatial safety in our massive C++ codebase by hardening libc++ *by default*. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: security.googleblog.com/2024…
Alex Rebert retweeted
The dedication and hard work has payed off: "for hundreds of complex web applications that are built on Google’s hardened and safe-by-design frameworks, we've averaged less than one XSS report per year in total" (see page 9 of the whitepaper).
Secure by design takes dedication and years of hard work to get the balance right between velocity and safety. Read a bit about @Google’s commitment and journey in our new white paper. Humbled to work with the professionals that make this happen everyday. blog.google/technology/safet…
Alex Rebert retweeted
Percentage of codebase that's memory-safe 📈, memory-safety vulns 📉,
EVEN IF YOU KEEP ADDING LINES OF C 🤯
NEW EPISODE!
You may not be rewriting the world in Rust, but if you walk like the Android team, you'll drive down your memory-unsafety vulnerabilities more than 2X below the industry average over time! 🎉
securitycryptographywhatever…
youtu.be/WL4CgVI6p9g
Alex Rebert retweeted
Released a blog about our @theori_io AIxCC experience! medium.com/@sa-blog/winning-…
@tjbecker and I were hoping to have more info about other challenges, but they aren't released, so some of the information is a bit limited.
Still, hope folks can enjoy reading it!
Alex Rebert retweeted
Excited to share this blog post about server-side memory corruption that my team exploited in production.
Shout-out to @scannell_simon, @epereiralopez, and @thatjiaozi - this was a very fun project. :-)
bughunters.google.com/blog/6…
Alex Rebert retweeted
"just as our efforts to eliminate XSS attacks through tooling showed, removing large classes of exploits both directly benefits consumers of software and allows us to move our focus to addressing further classes of security vulnerabilities."
security.googleblog.com/2024…
Alex Rebert retweeted
Today I spoke on the importance of Secure by Design on behalf of @Google alongside @CISAgov @FDD @VenableLLP & more. We also launched a paper on @Google's approach to Secure by Design & published on how it can be applied to address memory safety vulns: blog.google/technology/safet…
Alex Rebert retweeted
Ever struggle with C++ buffer issues? Spatial Safety is one of the main root causes for in-the-wild exploits! Read more about how we piloted the LLVM proposal for C++ Buffer Hardening here:
bughunters.google.com/blog/6…
Alex Rebert retweeted
this is a big one… if you have opinions on this, make sure that they are heard 👀
Fact Sheet: Office of the National Cyber Director Requests Public Comment on Open-Source Software Security and Memory Safe Programming Languages | ONCD | The White House m.cje.io/3s2Xz6t
Alex Rebert retweeted
I’m excited to announce the AI Cyber Challenge, a major, two-year @DARPA competition challenging the best and the brightest in cybersecurity and AI to secure the systems on which all American rely.
aicyberchallenge.com
Alex Rebert retweeted
Announced at the #BlackHat keynote: @Google, @OpenAI, @Anthropic, and @Microsoft will collaborate with @DARPA for its AI Cyber Challenge – a 2-year competition aimed at driving innovation at the nexus of AI and cybersecurity. Read more here: whitehouse.gov/briefing-room…
Alex Rebert retweeted
🗣️ My C++Now keynote “safety と security: the future of C++” is going live in 17 hours!
youtu.be/Gh79wcGJdTg
Alex Rebert retweeted
At some point last fall/winter I felt like giving up on everything. I don’t know where i got the energy to keep going, but def one place was my work.
Today, that work officially paid off:
git.kernel.org/pub/scm/linux…
Fuzzer will be open sourced soon :)
Alex Rebert retweeted
Ahoy mateys! PlaidCTF be settin' sail in less than 3 bells!
Register now and join us on the 7 seas, arrr!
plaidctf.com
Alex Rebert retweeted
For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerabilities across products, and across the industry. On Android, we’re now seeing something different:
security.googleblog.com/2022…
Alex Rebert retweeted
Poor software memory management is the culprit behind many bugs and vulnerabilities. Learn how to prevent and mitigate these issues: nsa.gov/Press-Room/News-High…
