Attacking through the Software Supply Chain
summary
Covers concrete supply-chain incidents and fixes: SolarWinds Orion backdoor that pushed malicious updates to global enterprise customers, NotPetya delivered via MeDoc auto‑update that crippled thousands and cost hundreds of millions, Codecov’s altered bash uploader that exfiltrated build secrets, UAParser.js and PHP repo compromises, and a PyTorch nightly-packages dependency confusion that uploaded environment variables and SSH keys. Estimates include ~100 million devices vulnerable to Log4j. Recommends reproducible builds, SBOMs, SLSA/Salsa checks, OWASP SAMM and NIST SSDF for measurable remediation.
AI-written summary · about
chapters (13)
- 0:00Software supply chain attacks
- 1:50Supply chain breach case studies
- 11:10Open source vulnerabilities
- 14:20Third-party dependency threats
- 17:13Dependency confusion attacks
- 21:43Choosing safe libraries
- 26:05Log4j vulnerability impact
- 29:17Patching embedded systems
- 32:06Securing development lifecycle
- 38:24Security improvement frameworks
- 45:48Compliance for supply chain security
- 49:11Summary
- 50:24Q&A
related talks
41mHow to protect your software project from supply chain security threats
32mHacking the OSS Supply Chain
37mSupply Chain Attacks and the Future of Software Delivery
39mSoftware Supply Chain Security
25mSupply Chain Attacks
15mSoftware Supply Chain Security for those in a rush
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
46mThe Rise of Malware Within the Software Supply Chain