Dependency Confusion as an Attack Vector (Cybersecurity heads-up!)

This is a quick cybersecurity-related rant. Or rather, a short shoutout to get you to check this latest attack that's out there, using developer laptops and CICD pipelines as an attack vector. Do you have a security tool scanning your packages for known vulnerabilities as a part of your pipeline? Nice, but it's not going to protect you.

If you don't know the term 'dependency confusion' yet - time to read about it. You can watch my short video as an intro, then educate yourself with the links below. Believe me, this is a nasty one, and every software dev should know about this, pretty much.

Here are the links in this video:

[czczr]

My all time favourite (conceptually) attack is however typosquatting, but think of it expanded into libraries. Ie, you get a foothold of some sorry developer that happened to typo a common library name and just did their first pull. You'd probably just make a fork of the origin library, to avoid breaking things too badly and retain the foothold for a while. After that it's easy sailing, because developers are lazy (but important), and thus, have elevated access credentials by default.

It's still the same it was in the 90s. Security is not a question of technology, but convenience and human lazyness (I say lazy without any moral point). Perhaps the normal lazy developer was not "designed" to function well in a closed corporate environments that must value secrecy. Perhaps the only environment where the lazy developer can truly thrive is one where all code is open source and there are no secrets. :shrug: