The internet is broken: breaking down the software supply chain
summary
Modern software supply chains concentrate risk: a GitHub scan finds 10 million secrets and about 2 million cloud keys exposed in one year, npm packages like UA‑Parser and event‑stream get hijacked and turned malicious, and CI tooling breach (Codecov adds exfiltration on line 525) lets attackers steal environment variables across customers. Real incidents include leaked Toyota app credentials and Twitch’s repo with 6,000 secrets. Defenses that actually help: secret scanning (GG Shield), SCA and SBOM generation, MFA, dynamic secrets, and honeytokens.
AI-written summary · about
chapters (12)
- 0:00Start
- 4:33The internet- a brief
- 5:49What we have in mind when we hear "software supply chain"
- 6:52Hackonomics 101
- 8:30A Modern Software Supply Chain
- 9:29Software Dependencies
- 14:30Credential stealer & crypto miner
- 16:09Event stream breach
- 20:19Monitoring GitHub
- 22:31Involuntary open-source
- 22:45Twitch Source Code Leak (Oct '21)
- 27:59Hardening the supply chain Managing Secrets
related talks
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
15mSoftware Supply Chain Security for those in a rush
46mApplication security from start to finish
24mHow to Find Secure Software in Open Source Repositories
41mManaging the Risk of Software Supply Chain Attacks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack