Steel for Vulnerabilities, Silver for Zombies: Hunting Java's Unseen Monsters
summary
Dependabot and Snyk catch CVEs but miss libraries that are End‑of‑Life: modern Java apps are ~10% original code, rely on ~150 dependencies, and about 75% of that tree never executes, creating zombie dependencies that SCA tools don’t flag. Attackers use AI and “weaponized reproducers” to map CVEs onto old releases; CVE processing often takes 8–10 weeks. OpenSSF Scorecards, deps.dev and HeroDevs’ free EOL database plus a CLI expose unsupported packages; an Exhume visualization is in progress as a follow‑up.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:24Software supply chain
- 8:22Unused dependencies risks
- 12:34SCA tools limitations
- 18:57Weaponized reproducers
- 23:56CVE reporting process
- 25:43New legislation
- 27:50Open source maintenance crisis
- 30:39Zombie dependencies
- 33:06Unmaintained software silence
- 36:59End-of-life dependency detection
- 37:20Second sword for zombies
- 40:28Zombie dependency tools
- 41:32Q&A
related talks
39mCVE 101: The Unfolding Of A Zero Day Attack
56mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
37mThe Death Star and the Ultimate Vulnerability
48mCommon vulnerabilities you wish your Java app didn't have!
39mWe Are All Equifax: The Data Behind DevSecOps
46mLive hacking: Breaking into your Java web app
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet