curl | bash | hacked: The Unseen Dangers in Your Dev Lifecycle
summary
curl | bash routinely hands attackers full user privileges by hiding malicious scripts behind browser-only responses and altered copy buttons; demos show a curl -k user-agent trick that returns different scripts to curl than to a browser, and a mirror-as-proxy (-x) config abuse that silently injects -k via local config. Exfiltration uses HTTP, DNS tunneling, ICMP and public APIs; concrete breaches include half a million malicious packages in 2024, 29M GitHub secrets leaked, 85% using wrappers but <1% verified, and only 0.05% of developers review install scripts.
AI-written summary · about
chapters (9)
- 0:00Introduction and welcome
- 2:27Curl bash vulnerability explained
- 10:28Data exfiltration methods
- 16:31Live demos of attacks
- 23:16Config files and build tools as targets
- 26:48CI/CD and production system risks
- 30:18AI and dependency management dangers
- 32:46Mitigation and security practices
- 36:23Real-world attacks and conclusion
related talks
41mLive Hacking: Breaking into Your Web App
38mSecurity And Modern Software Deployment
26mStranger Danger: Your Attack Surface Just Got Bigger
01h 00mThe Hand That Feeds: How to Misuse Kubernetes
47mLive Hacking: Breaking into Your Web App
40mDevOoops (Increase awareness around DevOps infra security)
01h 06mHow hacking works
40mLive hacking: Breaking into your web app