Are We Ready For The Next Cyber Security Crisis Like Log4Shell?
summary
Live demo shows a reverse shell created by adding a crafted dependency to a Spring Boot project and by exploiting Maven/npm resolution — a combo of dependency confusion and a compromised build cache that gives interactive access via nc; example stats: Spring Boot starter pulls 49 transitive libs, 13% of Maven Log4j downloads remain vulnerable, ~50% of Kubernetes clusters are EOL. Recommended fixes: pin versions, reserve namespaces and enable 2FA, enforce lockfiles and checksums, run SCA and generate SBOM (CycloneDX, Dependency-Track), use hardened images and a dependency firewall or artifact signing.
AI-written summary · about
chapters (10)
- 0:00Cyber security crisis readiness
- 2:03Blindly copying commands
- 11:46Supply chain attacks
- 24:49Immediate protection steps
- 27:35Long-term security recommendations
- 33:14Advanced defense tools
- 36:32SBOMs for vulnerability monitoring
- 40:45Prioritizing security fixes
- 43:11People and processes in security
- 44:14Conclusion and call to action
related talks
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
02h 38mJava application security the hard way - a workshop for the serious developer
25mDevSecOps by Default: What have, can and must we learn from Log4Shell?
50mStranger Danger: Your Java Attack Surface Just Got Bigger