OpenSource as an attack vector: how dangerous is it and how to fix it?
summary
Examines vulnerabilities originating from open-source components and libraries that become attack vectors, using real-world examples of notable attacks through external dependencies. Describes common patterns of these supply-chain threats and discusses practical measures to detect, mitigate, and remediate such risks in high-load systems.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:09What is Open Source
- 9:28Vulnerabilities in popular libraries
- 13:04Code analysis tools
- 18:07Log4Shell vulnerability
- 23:04Attacks via extensions
- 27:17Load balancer issues
- 32:12Internal service research
- 35:22Q&A
- 51:19Summary
related talks
32mWhy You Should Care About Open Source Supply Chain Security
18mIT Security – Don’t let Open Source Software become the next menace
40mSecure Your Code from Open Source Vulnerabilities
38mApplication Security in the age of Open Source
25mOWASP Top 10 Risks for Open Source Software
07mHow to Secure Your End-to-end Supply Chain
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
39mOpen Source Software Supply Chain Security — Why does it matter?