Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Trusting SDKs

Felix Krause
September 05, 2018
Programming
1
850

Trusting SDKs

Using third party SDKs significantly speeds up your development process. Felix talks about the risks of depending on external code, and how an attacker can easily inject malicious code in software you bundle within your app.

Felix Krause

September 05, 2018
Tweet

More Decks by Felix Krause

See All by Felix Krause
2017-10 Pragma: Getting started contributing to open source projects
krausefx
1
90
How to get get started contributing to open source
krausefx
3
660
Scaling Open Source Communities trySwift Tokyo
krausefx
2
1.2k
Scaling Open Source Communitites
krausefx
0
67
MCEConf Warsaw
krausefx
2
420
NSMeetup San Francisco
krausefx
1
150
fastlane - Felix Krause - Swift Language User Group
krausefx
1
24k
fastlane - Continuous Delivery for iOS Apps
krausefx
1
380
fastlane - Continuous Delivery for iOS Apps
krausefx
0
120

Other Decks in Programming

See All in Programming
PSR-15 はあなたのための ものではない？ - phpcon2024
myamagishi
0
110
LLM Supervised Fine-tuningの理論と実践
datanalyticslabo
5
1.2k
Amazon S3 NYJavaSIG 2024-12-12
sullis
0
100
「Chatwork」Android版アプリを 支える単体テストの現在
okuzawats
0
180
命名をリントする
chiroruxx
1
410
menu基盤チームによるGoogle Cloudの活用事例~Application Integration, Cloud Tasks編~
yoshifumi_ishikura
0
110
fs2-io を試してたらバグを見つけて直した話
chencmd
0
230
103 Early Hints
sugi_0000
1
230
【re:Growth 2024】 Aurora DSQL をちゃんと話します！
maroon1st
0
770
Stackless и stackful? Корутины и асинхронность в Go
lamodatech
0
750
Fibonacci Function Gallery - Part 1
philipschwarz
PRO
0
220
rails statsで大解剖 🔍 “B/43流” のRailsの育て方を歴史とともに振り返ります
shoheimitani
2
930

Featured

See All Featured
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
44
9.3k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
127
18k
YesSQL, Process and Tooling at Scale
rocio
169
14k
Building Better People: How to give real-time feedback that sticks.
wjessup
365
19k
What's in a price? How to price your products and services
michaelherold
243
12k
How to Think Like a Performance Engineer
csswizardry
22
1.2k
Product Roadmaps are Hard
iamctodd
PRO
49
11k
The World Runs on Bad Software
bkeepers
PRO
65
11k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.3k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
8
1.2k
The Cost Of JavaScript in 2023
addyosmani
45
7k
Bash Introduction
62gerente
608
210k

Transcript

  1. Trusting SDKs @KrauseFx Felix Krause <[email protected]>

  2. ☺

  3. 31% of the top SDKs affected

  4. Worst case?

  5. Web Security 101

  6. HTTP HTTPS

  7. None

  8. Obligatory OSI layer diagram

  9. None
  10. None

  11. CocoaPods

  12. None

  13. https://s3.aws.com/localytics-sdks/sdk.zip https://s3.aws.com/localytics-binaries/sdk.zip

  14. None
  15. None
  16. None
  17. None
  18. None
  19. None
  20. None
  21. None
  22. None
  23. None
  24. None

  25. 32% 68% Not vulnerable to simple network attacks Vulnerable

  26. 1 resolved within 3 days 5 resolved within 1 month

    5 unresolved to this day 2 resolved within 6 months SDK providers’ reaction time

  27. Open Source vs Closed Source

  28. github.com/trusting-sdks/https

  29. @KrauseFx