Recent incidents like the event-stream package compromise show how attackers can turn developers into a distribution channel for malware.
Vulnerabilities in common dependencies, like Apache Struts which led to the Equifax breach, highlight the danger of unmanaged open-source code.
The software supply chain mirrors a manufacturing process, and attackers exploit its weakest links to create cascading failures.
Attacks like dependency confusion and prototype pollution, exemplified by the SolarWinds incident, necessitate a zero trust security model.
Secure your development pipeline by using frameworks from OpenSSF, implementing SBOMs, and securing code, containers, and secrets.
A practical demonstration shows how prototype pollution can bypass input validation in a Node.js application by passing an array instead of a string.
This live hacking demo shows how the Log4j (Log4Shell) vulnerability allows an attacker to achieve remote code execution on a vulnerable server.
A vulnerable version of the Python Celery library is exploited to achieve remote code execution and exfiltrate server information.
The key to better security is creating a developer-friendly environment and engaging with communities like OWASP to stay informed.
The speaker shares her career journey, tips for students entering cybersecurity, and thoughts on social engineering and learning resources.
tree-IT GmbH
Bad Neustadt an der Saale, Germany
Bitpanda
Vienna, Austria
1:58:59Vandana Verma Sehgal
44:30Milecia McGregor
2:08:06Antonio de Mello & Amine Abed
29:34Reto Kaeser
40:38Anna Bacher
33:20Aarno Aukia
29:50Kevin Lewis
51:41Panel Discussion
.gif?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
Core4ce LLC
Punk Security Ltd.
Valiant Harbor International, LLC
Lincoln, United States of America
