Hacking the OSS Supply Chain
summary
Covers concrete attacks and fixes: SolarWinds uses a compromised CI/CD to inject ~400 lines of backdoor code; Equifax leak costs $1.43 billion and 143 million records exposed; Log4Shell enables remote class loading across Java hosts. Shows npm dependency confusion that let attackers raise 50 packages to 218 against Azure namespaces, and a PyPI scan with 6,000 PyPI hits and ~30,000 combined downloads of malicious wheels. Proposes Persia decentralized registry using libp2p, multi-node reproducible builds and a blockchain transparency ledger to verify binaries.
AI-written summary · about
chapters (9)
- 0:00Start
- 9:01Dependency Confusion Attack - Exfiltration
- 9:18Dependency Confusion Attack - Package Mining
- 10:36Dependency Confusion Attack - Confusion
- 23:19Supply-chain Levels for Software Artifacts
- 24:20PYRSIA - TRUSTED BINARY NETWORK
- 25:21PYRSIA BINARY DISTRIBUTION NETWORK
- 26:11GREEK ORIGIN OF PYRSIA
- 27:39The Infinity War is Happening
related talks
13mKeynote: Hacking the OSS Supply Chain
13mKeynote: Hacking the OSS Supply Chain
42mHacking the OSS Supply Chain
10mHacking the OSS Supply Chain
58mAttacking through the Software Supply Chain
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack