Keynote: Hacking the OSS Supply Chain
summary
Developers rely on ~80% open source in typical apps and attackers exploit that: Equifax causes ~$1.4B cleanup and $1.38B consumer claims affecting 143M customers; SolarWinds attackers replace a TeamCity-built binary; Log4Shell forces global Java updates. Research finds ~400 zero days, a scan of ~300,000 PyPI packages yields ~6,000 suspicious hits, and 218 typo-squatted packages. Practical defenses include using an artifact management system, guarding against dependency confusion, and experimenting with Perseid multi-node verification.
AI-written summary · about
chapters (8)
- 0:00Introduction to OSS supply chain
- 1:25Famous OSS supply chain hacks
- 3:55Risks of blind dependency trust
- 5:19Dependency confusion attacks
- 7:47Python package registry risks
- 9:55Typo squatting vulnerabilities
- 10:35Community security efforts
- 11:59Call to action for developers
related talks
13mKeynote: Hacking the OSS Supply Chain
32mHacking the OSS Supply Chain
42mHacking the OSS Supply Chain
11mKeynote: Securing Open Source
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
41mHow to protect your software project from supply chain security threats
48mHacking the software supply chain one developer at a time
10mHacking the OSS Supply Chain