Source Pollution Attack - A Hidden Threat in Cybersecurity
summary
Source pollution means external feeds can be manipulated to break detection and cause real harm: the talk shows drum hash collisions that make C2 and benign servers indistinguishable, a getdns backslash-zero bug that corrupts DNS JSON parsing, DShield and third‑party lists that accidentally block legitimate /24s, and an npm metadata mismatch that causes unexpected dependency downloads and can lead to RCE. Concrete fixes: multifactor validation of feeds, maintain backup sources, vet third‑party lists, and treat LLMs and SOAR connectors as untrusted parsers.
AI-written summary · about
chapters (12)
- 0:00Source Pollution Attack intro
- 1:33Speaker intro
- 3:07Sources protect infrastructure
- 6:46Defining sources
- 10:19Sources and CTI
- 17:27Polluted sources threats
- 18:59DRUM Hashes confusion case
- 21:28DNS handling tool limits case
- 23:20DoS via misleading lists case
- 25:31NPM downloads unwanted case
- 28:42Mitigation strategies
- 31:21Conclusion and Key Takeaways
related talks
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
56mModern Web Vulnerabilities 2020
01h 02mProtect Yourself Against Supply Chain Attacks
32mIs the Internet on Fire? Strategies for Mitigating Open Source...
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
25mSupply Chain Attacks
33mHacking The Front-End
18mIT Security – Don’t let Open Source Software become the next menace