Broken Links: Emergence and Future of Software-Supply Chain Compromises
summary
Charting real incidents shows supply-chain compromises using signed binaries, package repos and app stores to reach millions: HandBrake distributes Proton Mac malware for days, Medoc seeds NotPetya, UltraEdit’s Operation Wily Supply exposes ~two dozen firms for one day, a Chrome extension and CCleaner infect millions and 18 firms respectively, npm event-stream hits ~8 million over three months, Docker Hub images run miners for ten months yielding 545 Monero (~$90k), researchers find 112 stolen certs, 80% not revoked and a tester commits to homebrew master branch in 30 minutes. Defenses are EDR plus file-inventory, tightened app catalogs, GPO-managed extensions and tabletop response exercises.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:42Handbrake and NotPetia
- 4:23System of Supply Chain Attacks
- 4:49Whats driving these attacks
- 7:15How attackers adapt
- 10:33Software diversity
- 11:40Software diversity metrics
- 12:47How do security teams cope
- 13:41Trends and patterns
- 16:48Challenges with detection
- 18:41Homebrew
- 20:01How do we respond
- 24:44Tabletop scenarios
- 25:19Data providers
- 27:26Summary
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
46mThe Rise of Malware Within the Software Supply Chain
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
31mKeynote: The State of JavaScript Supply Chain Security in 2022
13mKeynote: Hacking the OSS Supply Chain
25mWhen the supply chain hits a sour note
31mThe internet is broken: breaking down the software supply chain