Dustico

Open-source supply-chain security

[Dustico @DusticoSec]

In this blog post by our CEO Tzachi Zornstain, he explains it’s difficult and time-consuming to validate the #identity of the #opensource contributor.

#supplychainsecurity

https://t.co/SH7elrBTp1

[Dustico @DusticoSec]

Last month PHP source code repo was hacked. Luckily the backdoor was reverted. Are we sure this was a single incident?

Check out our blogpost 👇
https://t.co/tcMfGjZjWf

[Dustico @DusticoSec]

Our automatic open-source analysis engine reported a spike in the past hours of malicious activity.

Thousands of open-source packages, all sharing the same code are being published with random names by what seems like an ethical hacker.

Check it out - https://t.co/ZTDs9CUq9b

[Dustico @DusticoSec]

Our research team came across a technique that allowed code to run on hundreds of servers worldwide without an installation.

What we found is when a user only downloads a Python package, the code inside will automatically run on the developer's system.

https://t.co/6BP8VMtud8

[Dustico @DusticoSec]

During this weekend new hackers started copycatting this attack (https://t.co/l3xcXehGmn).

[Dustico @DusticoSec]

Last week a novel open-source software supply-chain attack was discovered by @alxbrsn.

During this weekend, hackers started copycatting this (link in comments)

In order to detect if you are vulnerable, we have released “DustiLock” an open-source tool - https://t.co/qmpZXzmQeL

[Dustico @DusticoSec]

This technique was demonstrated to be effective against sensitive systems inside Microsoft, Apple, Netflix, and many others.

[Dustico @DusticoSec]

In some cases, an attacker can publish a public package with a name of a private package as well as a higher version number. This will cause private artifact repositories to use the attackers' package during the build process.