Are We Ready For The Next Cyber Security Crisis Like Log4Shell?
summary
Live demo shows adding a harmless dependency (GSON / Express) triggers a reverse shell via dependency install that connects outbound to an attacker listening on port 4242, giving interactive root access on an empty remote server. A fresh Spring Boot app pulls 49 transitive libraries; 13% of Maven downloads still fetch vulnerable Log4j builds. Scans find Ubuntu base images with ~900 vulns versus a hardened image with one low vuln. Recommended fixes: SBOM embedded in jar, Maven enforcer/strict checksums, npm ignore-scripts, Dependabot/Renovate, and OWASP Dependency-Track.
AI-written summary · about
chapters (25)
- 0:00Cybersecurity crisis readiness
- 1:40Blindly copying commands
- 3:10Supply chain attack via Maven
- 8:07Reverse shell attack mechanism
- 9:10Software supply chain attacks
- 10:53SQL injection still matters
- 11:35Supply chain risks beyond Log4Shell
- 13:00Recent supply chain attacks impact
- 14:06Dependency confusion explained
- 16:33Deep dependency trees risks
- 17:37AI code and dependency risks
- 19:42AI model security risks
- 21:06CRUD microservices vulnerabilities
- 23:37Protecting against supply chain attacks
- 26:27Dependency management security
- 28:55Understanding SBOM importance
- 31:02Hardened images reduce vulnerabilities
- 34:34Real-time vulnerability blocking tools
- 36:18Monitoring SBOMs for zero-days
- 39:55Prioritizing fixes with scoring
- 40:39Technology limits in cybersecurity
- 41:21DevSecOps culture and governance
- 42:45Shift-left security and threat modeling
- 43:49Production security and bug bounties
- 44:13Conclusion and legacy code
related talks
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
50mStranger Danger: Your Java Attack Surface Just Got Bigger
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
48mThe Hidden Security Hazards in Your Java Stack
02h 38mJava application security the hard way - a workshop for the serious developer