Snow Nor Rain Nor Dependency Confusion: How to...
summary
Used an automated confused script to scan internal repos and find 984 npm packages vulnerable to dependency confusion, then target a non-blocking lint package, publish a malicious npm package, and refine it after a naive build is flagged: payload encryption keyed to a company-wide config file hash, deployment to npm nets about 20 shells, persistence via cron, mTLS Python C2, exfiltration of SSH keys and a GitHub PAT, and a pushed proof-of-concept commit. Mitigations tested include placeholder packages, artifactory exclude rules, priority resolution, scopes, and version pinning.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 1:23What is dependency confusion
- 5:59Why npm is the primary target
- 6:22Planning the red team operation
- 8:30Building the malicious package
- 9:54Execution and results of the attack
- 13:21Fixing the vulnerability retroactively
- 17:38Placeholder packages as a quick fix
- 18:00Requiring npm scopes for packages
- 20:08Artifactory exclude rules
- 22:14Artifactory priority resolution
- 24:42Other mitigation strategies
- 25:26Q&A session
related talks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mAll your packages are belong to us - Protecting your npm dependencies
23mProtecting Your npm Dependencies
25mAnalysis of an exploited npm package
35mSupply Chain Attacks: Focused on NPM attacks
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
47mBlack Clouds and Silver Linings in Node.js Security