Open Source Supply Chain Threat Landscape - A Moving Target
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 11:15· HUB 2, New York, NY, USA·
summary
Sonatype runs Maven Central and observes enormous scale — Maven Central (≈700 billion downloads/year) — which exposes three attack phases: longstanding bugs (log4j left ~40% of downloads on vulnerable versions for a year), package-takeover/typo-squatting (mostly npm), and compromise of dev infrastructure. Automated ML modeled like credit-card fraud detection finds over 103,000 malicious instances (mostly npm). 96% of vulnerable downloads already had fixes available, yet remediation times vary from four days for prepared orgs to ~100 days for others.
AI-written summary · about
chapters (44)
- 0:00Introduction
- 0:30Context
- 2:25Supply Chain
- 2:40Edward Reever
- 3:13Chevy Cobalt
- 4:20Boeing 787
- 5:02Lettuce
- 6:12Old School Vulnerabilities
- 7:07First Vulnerabilities
- 7:48Shell Shock Heartbleed
- 8:16Commons Collection
- 10:06Log for Shell
- 11:28China
- 12:04New Rise of Open Source
- 12:43typo squatting attacks
- 13:28evolution of attacks
- 14:05attacks on developers
- 14:16Jenkins
- 14:40Vercata
- 15:08Code Cub
- 15:21Inversion
- 15:41White Hat Research
- 16:06Bug Bounties
- 16:34The attackers are still focused
- 16:58Global drug trade 2016
- 17:18VC funds investing in attackers
- 17:48Theyre looking for the easy way
- 18:39For the attackers right now
- 18:54This rise is not a coincidence
- 19:17Credit card fraud detection
- 20:10What do we do about it
- 20:25Theyre amateurs
- 21:03Fix Open Source
- 21:18Takata Airbag
- 21:50JYear on View
- 22:23Vulnerability Analysis
- 22:55Solving 4 of the Problem
- 24:15The Good News
- 24:58The Point
- 25:33How to avoid the next malicious release
- 26:10Factory Deming principles
- 26:47Security is most important
- 27:34People are faster and more secure
- 28:31Conclusion
related talks
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
18mSecuring Open Source in Nomura’s Software Supply Chain
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
42mHacking the OSS Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
33mThree Things That Each Developer Should Know to Help Secure Code Base