The Five Most Dangerous New Attack Techniques
summary
Yearly winners: software supply chain compromises (SolarWinds backdoor infecting tens of thousands, Dec 2020) and open-source attacks like dependency confusion (Alex Berson proves code execution at Apple, Microsoft, PayPal). Ransomware shifts to ransomware with exfiltration—Coveware reports ~70% Q4‑2020 cases include data theft—often uploaded via RClone/Mega renamed to evade detection. Defenses proven useful: software inventory and SBOMs, file‑integrity monitoring, OWASP Dependency‑Check/WhiteSource Bolt and RetireJS, regular threat hunting/purple teaming, stricter SSO/MFA token policies (expire, single use), and hard validation of crypto implementations.
AI-written summary · about
chapters (20)
- 0:00Start
- 2:36Undermining Software Integrity: A Hard Problem
- 4:06Recent Software Integrity Concerns
- 5:53Software Integrity - What You Can Do
- 8:44Improper Session Handling
- 11:20SSO in Action
- 12:05Crypto May Be Broken
- 13:25Mitigation Considerations
- 15:10Old Approach: Signatures
- 15:45New Samples: Good or Bad?
- 16:10Machine Learning, "Al" approach
- 17:13Attacks: Influence Training Data
- 18:55Attacks: Machine vs. Machine
- 19:58Or: Brute Force
- 21:10Ransomware: Just an Availability Problem?
- 21:452019: Maze Exfiltrates Data and Uses It to Extort Victims
- 22:32Exfiltration and Extortion Is the New Normal
- 22:47A Typical Ransomware Attack Chain
- 24:15No Honor Among Thieves
- 25:12What You Need to Change
related talks
46mThe 5 Most Dangerous New Attack Techniques and How to Counter Them
58mAttacking through the Software Supply Chain
52mLessons Learned from the Summer of Supply Chain Attacks
41mHow to protect your software project from supply chain security threats
46mThe Rise of Malware Within the Software Supply Chain
42mKeynote: The Expanding Universe of Cyber Threats
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
13mKeynote: Hacking the OSS Supply Chain