Category Archives: Conferences

QCon 2018 – Keynote – Developers as Malware Distribution Vehicle

Posted on by
Reply

Title: Developers as a Malware Distribution Vehicle
Speaker: Guy Podjarny @GuyPod

See the table of contents for more blog posts from the conference.

Developers have more power  than ever – can get more done and faster. Can also do more harm.

XCodeGhost – in 2015

  • XCode went from 3GB to 5GB
  • Too slow to download in China
  • Developers use a local mirror
  • Have to trust unofficial download
  • XCodeGhost is  XCode + a malicious component that compiles in to the OS. It targets the linker.
  • Went undetected for 4 months
  • Contamiated hunreds of Chinese apps and dozens of US apps
  • US got it fro Chinese built apps and via a lirary
  • Got up to 1.4M active victims a day
  • Apple fixed in AppStore imediately, but took months for users. Including enterprises
  • The real “fix” was to take down the websites were contacting
  • Apple fixed root problem by hosting official XCode download in China
  • Because targeted linker, developers were the distirbution vehicle.

Delphi virus – Induc – 2009

  • Targets Delphi
  • Every program copiled on machine is affected
  • Even if uninstall and reinstall Dephi, it stays
  • Took   10 minutes to find
  • No app store, so harder to remove
  • Affected millions

First instance of this concept  – 1984

  • ”Reflections  on Trusting Trust” – Ken Thompson
  • Modify C compiler to “miscompile”
  • Three trojans – allow a hard coded password, replicate the logic in C Compiler and use a disassembler to hide and deletes from source code
  • Wrote a proof of concept. Think didn’t escape Bell labs
  • Can’t find. Not in source code and can’t disassemble
  • Best soluion is to compile on two computers/compilers and compare the output. Not practical.

Malicious dependencies

  • npm bad  dependency
  • pipy  bad dependenc this year
  • Docker bad image this month

Must trust the people who write the software.

We ship code faster.   Hard to find if deveoper introduces code maliciously or accidentally.

Developers have access to user data Be careful

Syrian Army and Financial Times

  • phishing email
  • link redirects to finanicial times spoofed page
  • now have emails so send emails that look  like from finanical times
  • IT attempted to warn users.
  • Attacker send identical email with evil links
  • Gain access to official twitter
  • Syrian Army use to make statements
  • A developer noted that think wise to this and still fall for it. We all fall for this.
  • Salesforce did an internal phishing test and developers were the second higest clickers

Uber – 2016

  • Attackers  got driver and user data
  • Uber paid 100K ransom. Agreed later that shouldn’t
  • Public found out a year later
  • Developers had stored  S3 token in  private github repo
  • Not using 2FA
  • Deveopers can access extremely sensitive data and  share it too often

As we get more power, we need to get more responsible

Causes of  insecure decisions:

  • Different motivations  – focus    On functonality. Security is a constraint. Need to be cognizant of it
  • Cognitive limitations – we move fast and break things
  • Lack of expertise – don’t always understand security implications
  • Developers are overconfidence. Harder to train where think know it.
  • ”It doesn’t happen to me” .  Security breaches happen to everyone.

Mitigations

  • Learn from past incidents
  • Automate security controls
  • Make it easy to be secure
  • Developer education
  • Manage access like the tech giants
  • Challenge access requests.  When need. For how long. What happens  if don’t have access. What can go wrong with access? How would you find out about access being compromised?

Google BeyondCorp

  • All access route through corporate proxy
  • Proxy grants access per device – limits what can do from Starbucks
  • Monitoring access

Microsoft Privileged Access Workstations (PAW)

  • Access to production can only be from a secure machine
  • No internet from the secure machine
  • Your machine is VM  on secure machine

My take

Great start to the day. I had known about some of these, but not others. For some reason, this reminds me of developer ghost storires.

Qcon New York – 2018 Table of Contents

Posted on by
Reply

This year, I’m speaking and live blogging from QCon. New York.

140 speakers and 900 attendees. From 38 states plus international. Should be good! As I always, I like the hallway track, emphasis on useful badges, etc. I don’t remember “My QCon Trail” from last year. Goo way to see what you went to, how you voted and how others voted.

Wednesday

Thursday

  • A brief, opinionated history of the API — Joshua Bloch
  • AMA Josh Bloch
  • Investing in your Java Katalog – Don Raab & Aditi Mantri
  • Effective Java – Josh Bloch (I did a QCon interview for the first half of this session. I used the rest to prepare for my own session. Since I had seen Josh give this presentation before, it was nice hearing it again as “background” as I got ready though. It’s the kind of talk you get a little more from each time you hear it)
  • Mob Programming Mini Workshop – Harold Shinsato
  • Java 11 keeping  the release train on the right track – my talk. I can’t blog about my own session so here is a link to the slides
  • Yo. Ask me Anything – I was on this panel so no blog here either.

Friday

I wasn’t able to get Friday off from work so didn’t attend the conference that day.

javaone vs oracle code one

Posted on by
Reply

Oracle announced that they are turning JavaOne into Oracle Code One.  There was a lot of Twitter chatter that week. I want to add my two cents.

Tracks

First off all, JavaOne had two non-Java tracks last year:

  • Emerging Languages
  • Oracle Code: Containers, Microservices, DevOps, Databases, APIs and MOre

That means that 2/7 or approximately a quarter of the conference was already not about Java. I realize that’s not exact. Some of the topics in that quarter were about JVM languages. But it does show that JavaOne reflected the reality of polyglot developers and didn’t focus on “just” Java. (I think I remember there being some JavaScript stuff too, but maybe I’m remembering wrong.)

Two conferences

It’ll be interesting to see what if anything moves Oracle OpenWorld to Oracle code. Some of the Oracle technology specific sessions are about coding so maybe it is time for them to move.

Piloted at city events

Oracle ran Oracle Code in different cities. I went to (and spoke) at the New York City one. There was a good amount of Java there. There were also a good number of talks Java developers would find relevant even if they weren’t specific to Java. If that ratio of talks at Oracle Code One matches Oracle Code, I’ll be one happy developer.

Naming

  • DevNexus is a “Java focused” conference; they call themselves the second biggest Java conference in the US (or world; I forget.) They have non Java sessions – DevOps, JavaScript, etc. But no .NET at this time so they do cover what a JVM stack developer wants to know. Note they don’t Java in the name either and nobody is crying.
  • CodeRanch is a forum that used to be named JavaRanch. It’s still mostly JVM language focused, but the name also reflects that it is more than “just Java.”

Advice for Oracle

Remember the community. Jakarta EE might not belong to you, but it is an important part of the community. Make sure there are still talks on it.

Sentimentality

Change is hard. Personally, I really wanted to speak at JavaOne. So glad I got to last year before the opportunity was gone. That said, Oracle Code NYC was a good event so I expect Oracle Code One to be as well. And I want to speak there too. So now I have a new goal :).

Conclusion

The world isn’t ending. This isn’t the death of Java or the conference.  What makes “JavaOne” the flagship conference isn’t the name. It’s the people/venue/event/scale. So if you are a Java community leader/speaker, go again. Don’t make “the death of JavaOne” a self fulling prophecy.

And now off to submit my application…