Secret scanning in open source at scale (in-depth)
DESCRIPTION
Supply chain security conversation is booming these days after attacks like log4j came to the scene.
In this in-house research, we have conducted research on publicly available open-source assets like (JS packages), WordPress Plugins, and Ruby Gems to find out the presence of mistakenly or deliberately publicly exposed secrets (including private API keys and so on) i.e. AWS, Google, etc. (33 different types!)
This could pose a risk to anyone using those packages as dependencies or plugins so that this chain of not re-inventing the wheel could become a disaster that stops the wheel once and for all.
We are presenting our research done on a large scale after in-house scanning on:
- Around 2 Million+ NPM Packages. (almost all publicly available at the time of research)
- About 60,000 WordPress Plugins. (almost all publicly available at the time of research)
- Ruby Gems (almost all publicly available at the time of research)
We will demonstrate the numbers and the impact and will provide ways to prevent this and automation to integrate in your own ci/cd pipelines to prevent such disasters from happening.
WHY THE COMMITTEE CHOSE THIS TALK
After log4j, libxz more will come. Managing code security will be the big task for all defenders in the future.
