Are We Ready For The Next Cyber Security Crisis Like Log4Shell?
summary
Live demos show a build environment and dependency confusion can give an attacker an interactive shell: running Maven/npm install pulls a malicious package that initiates an outgoing reverse shell via malicious dependency, and the demo succeeds. Claims backed by numbers: Spring Boot pulls ~49 transitive deps, Express pulls ~65, and ~13% of Maven log4j downloads remain vulnerable. Practical defenses: SBOM + Dependency-Track for continuous monitoring, SCA tools (Snyk, Sonatype, Renovate/Dependabot), repository firewalls (JFrog/Xray, Nexus) and artifact signing.
AI-written summary · about
chapters (15)
- 0:00Next cyber security crisis
- 1:54Reverse shell attack demo
- 9:30Supply chain attacks
- 12:40OWASP Top 10 supply chain risks
- 14:05Supply chain compromises examples
- 15:53Dependency confusion
- 19:30AI threats and LLM poisoning
- 21:39SQL injection consequences
- 24:55Securing dependencies strategies
- 28:29Supply chain security measures
- 31:38Dependency scanning and SBOM
- 37:15Artifact security techniques
- 39:00Resilience after breach
- 43:57DevSecOps and human factor
- 45:41Conclusion
related talks
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
50mStranger Danger: Your Java Attack Surface Just Got Bigger
48mThe Hidden Security Hazards in Your Java Stack
31mOpen Source Supply Chain Threat Landscape - A Moving Target