Breaking the Chain: Advanced Offensive Strategies in Software Supply Chain
summary
Claims a string of real-world exploits with reproducible details: a $17,000 dependency confusion on HashiCorp Consul that installs public packages instead of private ones, a $30,000 NPX confusion that hijacks binary names for instant RCE, a $12,000 maintainer takeover via expired domain plus GitHub multi-email, cache poisoning of GitHub Actions (pull_request_target + action cache) to exfiltrate npm tokens, tooling names (dep, gate x) and millions‑of‑weekly‑install counts shown.
AI-written summary · about
chapters (12)
- 0:00Introduction to speaker
- 1:31Defining supply chain
- 2:59Threat landscape overview
- 3:54Attack surface analysis
- 5:18Source layer vulnerabilities
- 7:26HashiCorp case study
- 10:46NPX confusion technique
- 14:05Maintainer account takeovers
- 17:39Bypassing registry scanners
- 22:03Build layer and pipelines
- 25:07GitHub Actions research
- 29:44Collision-based phishing
related talks
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
32mHacking the OSS Supply Chain
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
13mKeynote: Hacking the OSS Supply Chain
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
25mWhen the supply chain hits a sour note
21mSupply Chain Attacks on Open Source: What's Happening, What...