Now I want to talk about something that is the coolest part of my job.
The security lab's mission is to build and inspire a community of hackers.
It's amazing to work with this community and it has been from day one of the job when my
colleague Kevin exploited a vulnerability in Apple's XNU to remotely shut down my phone.
Well by doing that, he inadvertently shut down all the Apple devices on the floor.
And my job is to distill all of this incredible collective security knowledge into this
feedback loop. Amplify it, scale it into actual security
results for everyone.
A fantastic example of this community feedback driven security is the story of Simon
Gerst. He had an idea as part of his university
studies that ended up helping thousands of organization.
Let me show you a video. Simon is studying cybersecurity in Germany.
He was reading a security blog post about an authentication bypass vulnerability in the NHS
covid 19 contact tracing app. This vulnerability is caused by an improper JWT
token signature verification.
He decided to code this pattern into a CodeQL query.
He proposed this query as a submission to our bounty program.
This query was merged into our open source repo and GitHub included it into our
standard CodeQL query suite.
So when the security lab was auditing GitHub's, open source dependencies,
we decided to run this query on DataHub.
DataHub is a popular open source database solution built by linkedin and with over 1900
forks on GitHub and more than five million pulls from docker hub.
And boom, this new query found an authentication bypass.
Our query result points to the faulty code with a detailed explanation and of the vulnerability
and remediation advice. So when we reported it to the DataHub team,
they were able to fix it quickly and they informed their downstream consumers with a GitHub
security advisory.
In the end what started as student research resulted in a fix that improved the security of
hundreds of organizations and projects who used DataHub and in an automated check that
protects thousands of Java open source projects for free.
Yeah. You can't believe it.
I know this is incredible, but but it's true
that's CodeQL for you. It's unique because it truly leverages the
power of community to drive security results at scale directly into the secure development life
cycles of maintainers and enterprises with each CodeQL community contribution hundreds of
thousands of projects across the GitHub ecosystem automatically become more secure.
Thank you.