Dependency Confusion Deep Dive

Scheduled: 12:10 (UTC+2)
Recording: https://www.youtube.com/watch?v=-0bOOgMWRVA

ependency Confusion caused quite a stir when it was made public in February 2021. It affects companies that run their own internal package repositories like Artifactory and Sonatype. The attack works by tricking a package repository like Artifactory to use a malicious upstream package rather than an internal package. In this talk we will dive into how Schibsted have mitigated this attack vector.

Stian Kristoffersen

Stian builds security tools in Schibsted’s Product and Application Security Team. Two of his Schibsted projects are open source: a dependency confusion tool called Artishock, and a secret manager called Strongbox.