1 of 13

jOpenSpace 2024

Miloš Havránek

Software Engineer

linkedin.com/in/miloshavranek

L. Casei Securitas

​

2 of 13

L. Casei Securitas - Dev to Devs

  • Use common sense
  • Trust but verify
  • Don’t overreach
  • Magic tools alone won’t save you

3 of 13

Covered intensively

​

Blind spots

​

Not covered

4 of 13

External threats vs. Internal threats

How to discover/implant exploitable weakness of/to a system?

Requires:

  • Access
  • Knowledge

Obtained through:

  • People
  • Source code
  • Open sourced Dependencies
  • Public API
  • …

5 of 13

The more dependencies, the more Adidas

6 of 13

Know your dependencies..

7 of 13

Supply chain attack, MavenGate

How?:

  • Claiming packages on official repository
  • Altering packages contents

Options:

  • Use private repository manager (DX neutral)
    • Proxy external repositories
    • Verify package signatures
    • Repository order matters!
  • Lock package signatures (DX negative)
  • SBOM + Software Composition Analysis (DX positive)

8 of 13

Public cloud - Github, Artifactory, ...

Allows:

  • Bypass nearly all other company security
  • Unlimited access through API token / ssh key without 2FA
  • Obtaining company assets
  • Providing access to 3rd party

​

​

​

9 of 13

Github Copilot - Syphoning secrets

10 of 13

Kernel level access for everything

  • XDR/EDR (Endpoint Detection and Response)
  • Anticheat
  • Antivirus

Negative Effects:

  • Slow computer (DX negative)
  • Sending your files, secrets
  • Attack vector + Rootkit
  • Single point of failure

11 of 13

What to read

12 of 13

How would

Jabba Developer

look like

​

Bonus 1

13 of 13

Bonus 2