Главная
Study mode:
on
1
Intro
2
We're going to demonstrate, with data...
3
About the report
4
Agenda
5
Data sources
6
Biases
7
Library usage is highly language dependent
8
Usage rate of popular libraries
9
SemVer, the closest we can get to a standard...
10
Definition / implications
11
Transitive by language (Fig 4)
12
Direct vs Transitive vulnerabilities (Figs 11-12)
13
More libraries = more problems? (Fig 13)
14
Language choice makes a difference (Fig 5)
15
OWASP Top Ten (Fig 6)
16
PHP is basically a minefield (Fig 7)
17
Not all vulnerabilities have exploits (Fig 8)
18
PoC exploits by OWASP category (Fig 10)
19
The vulnerability funnel (Fig 14)
20
Good news: most fixes are minor (Figs 16-17)
21
Begs many questions
22
How do the chains end?
23
Most chains are relatively short...
24
but it varies by language
25
Most updates are still small
26
Takeaways
Description:
Dive into a comprehensive analysis of open source library usage and vulnerabilities in software development during this 38-minute Black Hat conference talk. Explore data from over 85,000 applications and 500,000+ open source libraries, uncovering insights on dependency cascades, proof-of-concept exploits, and the impact of even small, popular libraries on application security. Examine language-specific trends, vulnerability patterns, and the implications of transitive dependencies. Learn about the OWASP Top Ten categories, exploit availability, and the vulnerability funnel. Gain valuable takeaways on managing library dependencies, understanding security risks, and making informed decisions about language choices and library updates in your software development process.

The Devils in the Dependency - Data Driven Software Composition Analysis

Black Hat
Add to list
0:00 / 0:00