Speaker: Stephen Chin
@steveonjava
Link to table of contents
———————
Theme is security with sci fi references
Examples
- Equifax data breah – from not patching Struts for at least two months
- Solarwinds – hacked TeamCity instance injected
- log4shell – zero day in log4j core. Affected almost all systems. Could send class file and having it excecute on the serer
- spring4shell
Binary repos
- Which do you trust?
- npm, pypi, rubygems, maven central
- Like picking up thumb drive off sidewalk and plugging into your production server
Dependency confusion attack
- Sci fi – Matrix – agents disguised theselves as other people
- package mining
- npm has no security on namespaces
- Can use same name as a company internal package and give it higher version number
- If grabing latest version, pull mallicious package
- When pull from npm, announcing what package you have
- Artifactory resolves against internal repo first. Protects even if using virtual repo which mixes public and private content
Supply Chain Attacks
- Sci fi: millinium falcon
- Assume depedencies built on a clean system
- Anyone can upoad to pipi
- About 400 zero day volunerabiities in open source/cloed source/OS, embedded systems, etc
- Sveder uploaded library to go to his website
- JFrog scans looking for suspicious Python code behavior
- noblesse – “optimizes your PC for python” – steals credit card/passwords and sends via dicord
- pythatoras – supposed to help with calculations but does remote code executio
Namespaces
- Sci fi: War games
- Moscow – Russia and Idaho
- St Petersburg – Russian and Florida
- azure-core-tracing is proper name. Created core-tracing.
- NPM took down once repored. At least 218 packages affected.
- Stole personal data
- Think bug bounty of test because minimal and not steaing credit cards
Pyrisa
- Scitfi: Avengers
- Need automated (IronMan), trustworthy (Black Widow) and dependable (Captain America)
- trusted binary network – secure by defaut, reliable inimal outages), open
- peer to peer
- multi-node verification
- reproducabe build trust model
Websites
- research.jfrog.com
My take
I hadn’t heard of all those attacks so learned about the Python ones. The sci fi element was a nice touch. As was the community picture with a ton of people on stage.