LIVE DEMO: Supply Chain Attacks in the Terraform Registry
summary
Live demo shows a malicious Terraform Registry module being swapped to a backdoored branch while keeping the same version, exploiting CloudFront caching and the X-Terraform-Version header to force victims to fetch it; the injected scripts spawn background PowerShell/SH processes that collect environment variables, SSH files and AWS/Azure CLI tokens, encrypt them, and exfiltrate via Azure login requests whose sign‑in logs are later reassembled. Module metrics show 51,000 downloads/week, standard scanners like Checkov miss the issue, HashiCorp refuses a CVE, and a module lock file tool is published to mitigate it by preventing republish same version attacks.
AI-written summary · about
chapters (21)
- 0:00Supply chain attacks intro
- 1:06What is a supply chain attack
- 3:15SolarWinds attack case
- 5:40NotPetya attack case
- 8:07XZ Utils attack case
- 11:39Attack stats and risks
- 13:27Open vs closed source vulns
- 14:53Live demo setup
- 19:16Publishing malicious module
- 21:26Attack success conditions
- 23:13Bypassing registry caching
- 24:03Executing the attack
- 26:12Exfiltrating credentials
- 27:58Retrieving Azure data
- 32:33Attack impact scale
- 33:17Checkov limitations
- 37:21Why attack undetected
- 38:44Reducing attack risks
- 41:51Mitigating exfiltration
- 44:01Protecting Terraform modules
- 45:08Q&A
related talks
47mLIVE DEMO: Supply Chain Attack in the Terraform Registry
05mUsing Terraform Safely
33mIn the Trenches During a Software Supply Chain Attack
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
32mHacking the OSS Supply Chain
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack