Risky Business #736 -- Azure misconfigurations are 2024's looming threat
Feb 13, 2024
auto_awesome
Expert Feross Aboukhadijeh discusses the influx of malicious code in repositories. Topics include Azure misconfigurations, Ivanti exploits, Starlink in Ukraine, and Canada's Flipper Zero crackdown. The podcast delves into the challenges in detecting and blocking malicious packages, cybersecurity trends like crypto attacks, and Discord token theft. A mix of security news and insightful discussions.
Malicious packages are a growing threat in JavaScript, Python, and Go ecosystems.
Lack of public threat information from major repositories like GitHub poses risks to users.
Legacy software analysis tools are slow in detecting emerging threats like malicious packages.
Deep dives
Significant Volume of Malicious Packages Detected Weekly
Sockit is identifying and blocking around 100 malicious packages every week in JavaScript, Python, and Go ecosystems. This includes various threats like typo squatting, dependency confusion, and malicious code, among others.
Lack of Visibility on Malicious Packages in Repositories
Despite reporting malicious packages for takedown, major repositories like GitHub do not provide notifications or maintain a public database for identified threats. This lack of visibility poses risks as users remain unaware if they have installed malicious packages.
Limited Public Record of Malicious Package Takedowns
While Socket reports and removes around 100 malicious packages weekly, the lack of public record keeping by major repositories like GitHub hinders awareness and the availability of threat information for users.
Challenges for Legacy Software Composition Analysis Tools
Legacy software composition analysis tools are reactive and slow in identifying emerging threats like malicious packages. Their reliance on CVE databases causes delays in detecting supply chain attacks and malware, creating security gaps.
Emerging Trends in Malicious Packages
Current trends show an increase in crypto-related attacks, with malicious packages targeting cryptocurrency assets and transactions. Additionally, there is a rise in attacks seeking to compromise Discord accounts for tokens and crypto-related activities.
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
Somehow there are still more Ivanti and Fortinet exploits
Volt Typhoon have been at it for years
Starlink in Ukraine gets complicated
Canadians hate poor Flipper
Much, much more…
In this week’s sponsor interview Feross Aboukhadijeh from Socket joins the show to talk about the sheer volume of malicious packages being committed to code repositories and why older SCA tools aren’t well equipped to deal with them.