Stranger Danger: Finding Security Vulnerabilities Before They Find You!
summary
Claims that many vulnerabilities hide in transitive packages: scans find 78% indirect-vulns and a demo to-do app shows a real path from dependency to app exploit. Shows a getcookies backdoor (≈40 lines) hidden via a compromised mailparser account with ~500k weekly downloads, and a marked XSS bypass that works because the browser autocorrects an HTML entity; the marked fix sits unpatched for >1 year. Recommends 2FA, responsible disclosure, non-major security releases and CI-integrated scans.
AI-written summary · about
chapters (5)
- 0:00Start
- 21:57from dependency vulnerabilities to application vulnerabilities
- 32:16Understanding the impact of security fixes
- 33:47Best Practices for Open Source Maintainers
- 35:41Open Source is Awesome
related talks
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code
50mStranger Danger: Your Java Attack Surface Just Got Bigger
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
55mBreaking and Fixing Web Application Security