Andrew Scott

Maintainer @OchronaSec / Product at @PaloAltoNtwks, ex @Expanseinc, ex @TenableSecurity - Views are my own

[Andrew Scott @drownedcoast]

@HamiltonCoEOC 156 and Ditch, heard and felt

[Andrew Scott @drownedcoast]

@rileyharden Heard and felt in Westfield

[Andrew Scott @drownedcoast]

Nice find @sonatype team!

[Ax Sharma @Ax_Sharma]

PyPI repository flooded with 1,200+ dependency confusion packages imitating well-known companies and #opensource Python projects 🐍.

Reported to PyPI by @sonatype and removed within an hour 👏👏👏

https://t.co/vkKiAEVOSW

[Ax Sharma @Ax_Sharma]

Scoop: Developer of popular 'colors' and 'faker' #opensource NPM projects has intentionally corrupted them—breaking THOUSANDS of projects that depend on them.

Done in retaliation against mega-corporations exploiting open source but not giving back:

https://t.co/YMskgBkmbo

[Geek Culture @_geekculture_]

The Python Vulnerability Landscape — by @drownedcoast https://t.co/tOiVR8fXXU

[Andrew Scott @drownedcoast]

Malicious PyPI Code Packages Rack Up Thousands of Downloads: https://t.co/S3YTtHGay8 via @threatpost

[BleepingComputer @BleepinComputer]

Malicious PyPI packages with over 10,000 downloads taken down - @Ax_Sharma
https://t.co/8SvdajDWGF

[Ax Sharma @Ax_Sharma]

👀 While performing large-scale static analysis of PyPI packages, @drownedcoast caught 3 malicious packages that target Windows & Linux machines, download #malware, and exfiltrate files related to Apache Mesos files.
https://t.co/oJ8fMOb6Cb

#OpenSource

[Andrew Scott @drownedcoast]

By doing text analysis on PyPI packages I identified 3 malicious packages, including one targeting ⁦@ApacheMesos⁩ that has been downloaded 10k times!

https://t.co/9IPxzwJ8UE ⁦@pypi⁩

[Andrew Scott @drownedcoast]

@pypi is security(at)Python(.)org the best place to report malicious packages on PyPI for takedown?

[Marcus Flowers @Marcus4Georgia]

My name is Marcus Flowers. I’m a U.S. Army Veteran, Democrat, and I believe in service.

At 18 years old, I swore an oath to defend the Constitution. That's why I’m running to unseat Marjorie Taylor Greene.

I have 255k followers. Can you give me a follow and join our campaign?

[Andrew Scott @drownedcoast]

I’m really excited to have some of my work featured in the latest tl;dr sec newsletter! https://t.co/PDozpLhwkY Check it out!

[Clint Gibler @clintgibler]

🐍 Ochrona by @drownedcoast

CLI tool for detecting vulnerabilities in Python dependencies and doing safe package installs

Has its own vuln DB, using data from:
* NIST NVD
* Github Advisory Database
* Vendor disclosures & blog posts
* PyPA Advisory DB

https://t.co/DFX7Hgkw9x

[Andrew Scott @drownedcoast]

I recently did some analysis on the over 10 years of Python vulnerabilities tracked by ⁦@OchronaSec⁩
https://t.co/DsGgVS0MWS #python #cybersecurity

[Andrew Scott @drownedcoast]

Ochrona 1.2.0 now supports @CycloneDX_Spec SBOM generation! Check out the latest release with this and other improvements. @OchronaSec @owasp #Python #sbom #DevSecOps

https://t.co/xREkqBhj9t

[Andrew Scott @drownedcoast]

@Andrew___Morris Scott is great!

[Andrew Scott @drownedcoast]

@allanfriedman @SPDXTeam @CycloneDX_Spec Thanks @allanfriedman! I was seeing both but didn’t know what actual adoption looked like.

[Andrew Scott @drownedcoast]

Hey #infosec, what’s the preferred SBoM standard?

[Andrew Scott @drownedcoast]

Want to make sure you’re only using dependencies with commercial-friendly licensing?
“license_type IN MIT,ISC,Apache-2.0…”

Want to make sure you’re not using dependencies that are no longer maintained?
“latest_update > NOW-90”

[Andrew Scott @drownedcoast]

As of v1.1.0, Ochrona now has support for generic policy definitions. This means you can now add additional contextual metadata checks to your Python dependency usage beyond vulnerable package usage. Oh, and you can express them in plain English. #python #CyberSecurity

[Andrew Scott @drownedcoast]

https://t.co/xREkqBhj9t