Speaker: Stephen Chin

@steveonjava

Link to table of contents

———————

Theme is security with sci fi references

Examples

• Equifax data breah – from not patching Struts for at least two months
• Solarwinds – hacked TeamCity instance injected
• log4shell – zero day in log4j core. Affected almost all systems. Could send class file and having it excecute on the serer
• spring4shell

Binary repos

• Which do you trust?
• npm, pypi, rubygems, maven central
• Like picking up thumb drive off sidewalk and plugging into your production server

Dependency confusion attack

• Sci fi – Matrix – agents disguised theselves as other people
• package mining
• npm has no security on namespaces
• Can use same name as a company internal package and give it higher version number
• If grabing latest version, pull mallicious package
• When pull from npm, announcing what package you have
• Artifactory resolves against internal repo first. Protects even if using virtual repo which mixes public and private content

Supply Chain Attacks

• Sci fi: millinium falcon
• Assume depedencies built on a clean system
• Anyone can upoad to pipi
• About 400 zero day volunerabiities in open source/cloed source/OS, embedded systems, etc
• Sveder uploaded library to go to his website
• JFrog scans looking for suspicious Python code behavior
• noblesse – “optimizes your PC for python” – steals credit card/passwords and sends via dicord
• pythatoras – supposed to help with calculations but does remote code executio

Namespaces

• Sci fi: War games
• Moscow – Russia and Idaho
• St Petersburg – Russian and Florida
• azure-core-tracing is proper name. Created core-tracing.
• NPM took down once repored. At least 218 packages affected.
• Stole personal data
• Think bug bounty of test because minimal and not steaing credit cards

Pyrisa

• Scitfi: Avengers
• Need automated (IronMan), trustworthy (Black Widow) and dependable (Captain America)
• trusted binary network – secure by defaut, reliable inimal outages), open
• peer to peer
• multi-node verification
• reproducabe build trust model

Websites

• research.jfrog.com

My take

I hadn’t heard of all those attacks so learned about the Python ones. The sci fi element was a nice touch. As was the community picture with a ton of people on stage.