Developers as a Malware Distribution Vehicle
summary
Covers real incidents where developers unintentionally distributed malware or leaked user data—examples include a malicious Xcode installer that injected trojans into thousands of iOS apps and leaked Uber records from tokens committed to GitHub. Explains attacker techniques used to compromise developer tooling and repositories (e.g., supply‑chain and credential/token exposure) and presents defensive practices developers can use to avoid being used as a malware distribution vector and to protect user data.
AI-written summary · about
chapters (14)
- 0:00Start
- 1:36Xcode is BIG...
- 2:26Xcode Ghost Malware
- 4:11Local Xcode downloads
- 6:29The Ken Thompson Hack
- 12:55Commands
- 19:34Malicious Docker Images (June 2018)
- 20:46Uber Hack Details
- 21:45Uber Hack of 2014
- 22:36Automate Security Controls
- 24:09Make it Easy to be Secure
- 25:57Compromised accounts on npm
- 26:47Developer Education
- 28:58Bug Bounty
related talks
41mHackers vs. Devs - Attacking Dev Tools and Infrastructure
47mSecurity Threats & Mitigations for iOS Developers
42mAngry Dev — what can a malicious developer do?
48mHacking the software supply chain one developer at a time
46mThe Rise of Malware Within the Software Supply Chain
25mMobile App Security: Threat Landscape
40mThe Mechanisms That Enable Misuse and What We Can Do About It
33mLearn to Think Like a Hacker