Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Supply Chain Attack

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Andreas Mosti Andreas Mosti
May 03, 2021
90
0

Supply Chain Attack

Talk I gave for Bekk Trondheim principles and practices group for security, spring 2021.

Avatar for Andreas Mosti

Andreas Mosti

May 03, 2021

More Decks by Andreas Mosti

See All by Andreas Mosti
Deterministic Builds and where to find them
Avatar for Andreas Mosti andmos
0
93
Correct Maps Are Useless: A guide to mental models
Avatar for Andreas Mosti andmos
0
220
LEGO I Praksis
Avatar for Andreas Mosti andmos
0
110
Supply Chain Attacks: Når den digitale forsyningslinja blir angrepsvektor
Avatar for Andreas Mosti andmos
0
55
IoIT: Internet of Insecure Things
Avatar for Andreas Mosti andmos
0
150
Containers'n stuff
Avatar for Andreas Mosti andmos
0
78
IoT - Bevisstgjøring
Avatar for Andreas Mosti andmos
0
72
GitOps in a nutshell
Avatar for Andreas Mosti andmos
0
240
OpenFaaS: Serverless platform with no strings attached?
Avatar for Andreas Mosti andmos
0
340

Featured

See All Featured
Neural Spatial Audio Processing for Sound Field Analysis and Control
Avatar for NII S. Koyama's Lab skoyamalab
0
540
Designing Powerful Visuals for Engaging Learning
Avatar for Mike Taylor tmiket
1
590
Jamie Indigo - Trashchat’s Guide to Black Boxes: Technical SEO Tactics for LLMs
Avatar for Tech SEO Connect techseoconnect
PRO
0
690
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
52
4k
Sharpening the Axe: The Primacy of Toolmaking
Avatar for Bryan Cantrill bcantrill
46
3k
Google's AI Overviews - The New Search
Avatar for Barry Adams badams
0
1.6k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
234
19k
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
2
930
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.9k
What does AI have to do with Human Rights?
Avatar for Per Axbom axbom
PRO
1
2.4k
Scaling GitHub
Avatar for Zach Holman holman
464
140k
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
Avatar for Ines Montani inesmontani
PRO
3
2.4k

Transcript

  1. Supply Chain Attack

  2. What’s a supply chain?

  3. None
  4. None
  5. None

  6. Ca. 1000 parts, most of them “passive”…

  7. But 35 critical components, single-source dependencies

  8. None
  9. None
  10. None

  11. 60 top level packages 20 providers 78 top level packages

    32 providers

  12. 60 top level packages 20 providers 78 top level packages

    32 providers 279 total packages 39 providers 3516 total packages ???? providers
  13. None
  14. None
  15. None

  16. “In an Internet Security Threat Report, powered by Symantec, it

    is stated that supply chain attacks still continue to be a feature of the threat landscape, with an increase by 78 percent in 2018.”
  17. None
  18. None

  19. We go to the markedplace

  20. None

  21. “None of the package hosting services can ever guarantee that

    all the code its users upload is malware-free”
  22. None

  23. Dependency Confusion

  24. None
  25. None
  26. None
  27. None

  28. Public Package Registry Private Package Registry Package.1.0.0 Package.2.3.0 Package.99.0.0 Package.5.3.0

  29. None
  30. None
  31. None

  32. Service breaches

  33. None
  34. None
  35. None
  36. None
  37. None
  38. None
  39. None
  40. None
  41. None
  42. None
  43. None
  44. None

  45. Worth mentioning: • Stolen signature key • Leaked API keys/passwords

    • ????

  46. How do we protect ourselves?