Are We Ready For The Next Cyber Security Crisis Like Log4Shell?
summary
An empty Spring Boot project plus one added Gson dependency triggers a live reverse shell when Maven verify runs against a malicious public package; an npm install of express@latest does the same — the demo uses a €4 hacker server and shows how a single dependency pull leads to interactive compromise. Express brings 65 subdependencies, 13% of Log4j downloads remain vulnerable, and a SQL injection → container root → Kubernetes root lateral path is reproducible. Defenses: strict checksums, Maven Enforcer, GPG signatures, pinned locks, Nexus/JFrog or repo filters, Renovate/Dependabot, and generating an SBOM (CycloneDX).
AI-written summary · about
chapters (26)
- 0:00Next cybersecurity crisis intro
- 1:50Reverse shell importance
- 3:57Live demo: Java supply chain attack
- 6:25Node.js supply chain attack
- 7:50Firewalls failed in attack
- 9:15Rising supply chain threats
- 10:18Classic attacks fueling threats
- 11:44Log4Shell aftermath risks
- 14:12Dependency confusion explained
- 17:02Transitive dependency risks
- 18:27AI code supply chain dangers
- 21:56SQL injection to cluster takeover
- 24:01Are we scared enough
- 24:23Reduce supply chain risks
- 27:31Never ignore package locks
- 29:17Protecting external repositories
- 31:24Immutability in releases
- 32:04Dependency scanning and SBOM
- 34:12SBOM in Java apps
- 35:58Hardened images boost
- 38:50Dependency firewalls
- 39:53Signing artifacts integrity
- 40:36Log4Shell lessons monitoring
- 43:21Prioritizing vulnerabilities
- 44:24Shift left human factor
- 45:50Conclusion and action
related talks
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
50mStranger Danger: Your Java Attack Surface Just Got Bigger
48mThe Hidden Security Hazards in Your Java Stack
48mCommon vulnerabilities you wish your Java app didn't have!