Your .NET App Is Probably Vulnerable Right Now
summary
Live demos show a malicious fake Newtonsoft.Json pushed into a NuGet cache that runs unexpected code, then remediation steps that successfully prevent it: use package source mapping, reserve name prefixes, enable trusted signers (noted broken on macOS), commit packages.lock.json and use dotnet restore --locked-mode, run dotnet list package --include-transitive and Trivy to scan licenses and vulnerabilities, emit CycloneDX/SPDX SBOMs with VEX context, and implement reproducible builds. Claims: 80% of production code is third‑party, fines up to €15M or 2% revenue, reporting required by Sept 2026; secure-by-design setup is built and works.
AI-written summary · about
chapters (29)
- 0:00Supply chain vulnerabilities
- 1:02Malicious package in Newtonsoft.Json
- 3:27What we will learn
- 4:12Supply chain attacks like SolarWinds
- 6:36Why supply chain security matters
- 6:57Cyber Resilience Act implications
- 10:14Understanding software supply chains
- 12:43Detecting vulnerabilities with dotnet list package
- 14:06NuGet audit in .NET 8 and 9
- 16:15License traps and legal risks
- 17:39Scanning licenses with Trivy
- 19:05Supply chain risk management basics
- 20:32Dependency confusion attacks
- 22:41Fixing dependency confusion with package source mapping
- 24:06Configuring NuGet for secure sources
- 27:18Typo squatting attacks and defenses
- 28:46Validating package signatures
- 30:32Reproducible builds and integrity
- 32:42Using package lock files
- 34:30Configuring MSBuild for reproducible builds
- 36:59Microsoft’s secure build package
- 37:45Enforcing secure package source mapping
- 39:10Creating secure .NET solution
- 40:16Generating SBOM with Trivy
- 41:43Understanding SBOM formats
- 43:07Runtime vulnerabilities and monitoring
- 43:29Vulnerability Exploitability Exchange
- 45:18Security frameworks for publishers
- 46:21Summary and call to action
related talks
57m.NET supply chain: Protecting against hidden threats
56m.NET supply chain: Protecting against hidden threats
46m.NET supply chain: Protecting against hidden threats
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
49mReducing Third-Party Security Risk in .NET Core Applications
58mSecuring your .NET application software supply-chain
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain