AppSec EU15 - Rory Mccune - Security And Modern Software Deployment

What Hacker News said

Cites raesene3 · 2016-03 · on “Vulnerability #319816 – npm fails to restrict the actions of malicious packages”

Kind of amusing that this is considered to need a new vuln. report, I kind of assumed it was common knowledge. Most of the programming language package repositories (e.g. npm, rubygems, PyPi, NuGet) have this kind of installation process and limited/no checks for malicious content. Also as there's no consistent use of package signing by the developer (it's either unsupported or not very used) there is also a risk of the repository itself being compromised. I did a talk last year for OWASP AppSecEU that covers this kind of thing. [this video]

Cites raesene10 · 2016-06 · on “Typosquatting programming language package managers”

For me they're very similar. I actually did a talk last year for OWASP AppsecEU where I started with the curl|bash bit and pointed out where rubygems/npm etc aren't really a lot better in some ways [this video]

Cites raesene6 · 2017-09 · on “Malicious software libraries found in PyPI posing as well known libraries”

This isn't, in any way, a new problem. I did a presentation on this topic for OWASP AppSecEU 2015 ( [this video] ) and when doing the research for that I encountered cases of repo. attacks and compromise. IME the problem will continue unless the customers (e.g. companies making use of the libraries hosted) are willing to pay more for a service with higher levels of assurance. The budget required to implement additional security at scale is quite high, and probably not a good match with a free (at point of use) service.