Android finally checks sideloaded apps for malware before installs

In response to growing cyber threats, Google has introduced an update to bolster Android security. This enhancement focuses on strengthening malware detection before app installations, ensuring a safer Android ecosystem.

With this update, Google Play Protect now conducts real-time scans at the code-level during the app installation process:

By providing users with immediate feedback about the safety of the apps they are installing, Google empowers its users to make...

19 October 2023 | Android

Sauce Labs exposes some developers’ risky habits

A survey by Sauce Labs of 500 US-based developers has put the spotlight on some concerning practices.

One alarming discovery was the tendency of developers to push code to production without adequate testing. 67 percent of respondents admitted to this practice, jeopardising software quality, user experience, and system stability.

Additionally, 68 percent confessed to merging their own pull requests without review—raising concerns about potential security...

3 October 2023 | Artificial Intelligence

GitHub opens Copilot Chat to all developers

GitHub has announced that Copilot Chat is now available to all developers, ushering in a new era of AI-powered software development.

Copilot Chat was launched for ‘Business’ users in July. The AI assistant is capable of assisting developers in their preferred natural language and promises to reduce repetitive tasks.

Developers can use the assistant to explore new languages or frameworks, troubleshoot bugs, and/or seek answers to coding questions, all while remaining...

21 September 2023 | Artificial Intelligence

Sonatype reveals DevOps and SecOps leaders’ views on generative AI

While the tech community remains divided on the potential of generative AI tools, there's a consensus that their impact on the industry is comparable to the adoption of cloud technology.

Software engineers are harnessing generative AI to explore libraries, create new code, and enhance their development process, while application security professionals employ it for code analysis and security testing.

A recent survey conducted by Sonatype in the US sheds light on how...

12 September 2023 | Artificial Intelligence

Mathew Payne, GitHub: Protecting code while nurturing user experience

Developer caught up with Mathew Payne, Principal Field Security Specialist at GitHub, to discuss the platform’s security strategies and how they aim to strike a balance between robustness and a seamless user experience.

At the heart of GitHub's security philosophy lies a commitment to safeguarding user code. Payne emphasised that a major focus is on securing the code created by both users and developers.

“The first thing that we focus on at GitHub is the security...

18 August 2023 | Development Tools

Malicious PyPI package discovered in ongoing ‘PaperPin’ campaign

In a recent analysis conducted by Sonatype, a malicious Python Package Index (PyPI) package named 'VMConnect' was discovered masquerading as the legitimate VMware vSphere connector module 'vConnector'.

The counterfeit package was found to contain sinister code designed to compromise users' systems. Further investigation revealed an ongoing campaign involving additional packages like "ethter" and "quantiumbase," all sharing the same structure and payload.

The 'VMConnect'...

4 August 2023 | Hacking & Security

Play Store loses over 260K apps following Google’s quality push

Android’s app ecosystem has experienced a significant decline in the number of available apps in recent years, according to data from Statista and AppBrain.

Three years ago, Android users had 295 million apps to choose from. However, by the end of 2021, that number had dropped drastically to 2.7 million, and the decline continued.

In January 2022, there were 2.64 million apps available—representing a staggering drop of 260,000 apps in just two years. Although the...

17 July 2023 | Android

GitHub introduces passwordless authentication

GitHub is introducing passwordless authentication to enhance account security and provide a more seamless user experience.

Passkeys are touted as offering a secure and easy-to-use method of protecting user accounts, with the aim of eliminating password-based breaches altogether. Unlike conventional security measures, passkeys offer improved security by combining two-factor authentication (2FA) with enhanced user verification.

Passkeys require something the user is or...

14 July 2023 | Development Tools

Sonatype uncovers further malicious PyPI and npm packages

Sonatype continues to uncover a significant number of malicious packages within the PyPI and npm software registries.

Among the flagged packages were several Python packages published on PyPI, masquerading as legitimate libraries named after the popular npm "colors" library.

The malicious packages, including names such as "broke-rcl," "brokescolors," and "trexcolors," exclusively targeted the Windows operating system. Once installed, these packages would initiate the...

23 June 2023 | Developer

AppSec teams stuck in catch-up cycle due to massive cloud-native enablement gap

A security camera surrounded by clouds.

Backslash Security, a cloud-native application security solution for enterprise AppSec teams, has released a new research study, Breaking the Catch-up Cycle: The New Cloud-Native AppSec Paradigm Survey Report, exploring how the state of application security has evolved given the rise of cloud-native application development.

The study examines the practices, tools, and needs of CISOs, AppSec managers, and AppSec engineers at enterprise organizations of 1,000 or more employees...

26 May 2023 | Developer