Tracking Attackers in Open Source Supply Chain Attacks: The New Frontier
summary
Shows concrete campaigns and countermeasures: an automated actor RED-LILI (1500 malicious packages) publishes thousands of poisoned packages; a public tracker RED-LILI Tracker (red-lili.info) catalogs timestamps, C2s and removals; account takeovers inject miners and password stealers into UA-Parser and others; a maintainer-published node-ipc protestware wipes with "❤️" targeted Russia/Belarus; typo-squatting (pumpy/pump eio) exfiltrates SSH keys; attackers use automation, DGA and EvilProxy MFA bypass; npm adds similarity checks and GitHub vetting; researchers build package-lab for hunting and share deleted samples.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:40Whats the problem
- 3:14Open Source is Critical
- 5:56Identity Theft
- 7:55Attackers Targeting Open Source
- 13:06Rhetoric Question
- 15:17Attackers evolving
- 17:43Cuteboy
- 20:06Wrong Package
- 21:44Package Lab
- 24:48Metadata
- 29:01The Trust Paradox
- 31:14Change the Mindset
- 36:45Summary
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
38mThe Risks of Blind Trust in Code from Strangers
16mNation-State Threats in the Open-Source Software Supply Chain
35mSupply Chain Attacks: Focused on NPM attacks
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
21mSupply Chain Attacks on Open Source: What's Happening, What...
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws