Speaker: Steve Poole

For more see the table of contents

• Doing Java 27 years
• True story. Happened to multiple people
• Company in the middle of nowhere
• Smart tv with an ethernet port
• Discover new wifi SSID
• Look everywhere for the router, use scanners and eventually learn it is the TV
• Asked supplier for instructions. Suppliers didn’t know had wifi either.
• Asked manufacturers how to configure wikif. Manfufacturer says no wifi in tv
• Take apart TV and discover ”system on a chip” with the wifi (had everything a computer needs like a raspberry pi)
• However, wasn’t the system on a chip (SOC) that the manufacturer shipped. Manufacturer may not know because SOC has extra capabilities they turn off. In this case, manufacturer says isn’t theirs
• Problem: open wiki, unsecured gateway
• This SOC phones home. Every time turn on TV, get new wifi and sends geolocation info to an IP.
• Anyone could ”drive by” and access the network. Can compromise other things on intranet

Implications

• Lots of thigs plugged into typical network – ex: printer/scanner. Could send your data
• We all know not to plug USB into computer. However, tiny charger can be compromised and send data
• A lot are espionage tools. More prevalent now.
• Software applications can be compromised too.
• Poor supply chain management
• If buy charging cable (vs data cable), know what it can do. Can’t tell by looking at it.

log4shell

• Worst vulnerability ever
• 33% log4j downloads from Maven Central
• Look at scanning tools and see if can find all instances
• 742% increase in vulnerabilities since last JavaOne. Actively trying to create log4j situation in open source

My take

Steve is a great speaker so I’m glad I got to see this. It was poorly attended. Possibly becuse of the location (on the exhibit floor) or possibly becuase people though the stage was all vendors. Granted this is a vendor talk too. But it took more than half of the talk to even allude to something that relates to Sonatype and that’s if you know what they do. Only the last two minutes was a direct tie (and even then didn’t mention their products by name)