5 ms·

In compiled/installed software, the concept of “supply chain risk” is at least a thing that companies are aware of. However, when it comes to web software, I ha

In compiled/installed software, the concept of “supply chain risk” is at least a thing that companies are aware of. However, when it comes to web software, I have not heard many companies really conceptualize their “supply chain” exposure from the myriad of scripts/dependencies injected via tag managers and other software. And it’s not just tag managers (GTM/DTM, etc) - React create app command builds a boilerplate with hundreds of packages as dependency. Has anyone employed any kind of automated scanning to try and catch known malicious code in these? On the tag manager front, I’m afraid the very premise of letting non-technical people manage code is what makes these a built-in vulnerability. Educating those in control as to risks seems to be the only option, in addition to normal malware scanning you have to do if you run ads.

patrickmn 8y ago
> I have not heard many companies really conceptualize their “supply chain” exposure from the myriad of scripts/dependencies injected via tag managers and other software. I made a thing called "TrackerMap" that allowed people, mostly Fortune 500 web/risk/compliance people, to do just that: https://www.crownpeak.com/products/monitoring-solutions/tag-auditor-with-trackermap https://www.crownpeak.com/products/monitoring-solutions/tag-... (It has since been acquired, and I have no affiliation.)
mjevans 8y ago
The 'supply chain' of docker and other sandboxed 'exact versions' request-able environments scare me. Horrid 'enterprisy' java applications showed everyone how bad things could get and those same mistakes are being replicated instead of learned from.
mey 8y ago
These come to mind for scanning for malicious dependencies https://www.blackducksoftware.com/ https://www.blackducksoftware.com/ https://www.sonatype.com/nexus-firewall https://www.sonatype.com/nexus-firewall I believe there are others, just pulling from memory.
scarface74 8y ago
The article also stated that the malware being a part of an installation utility gave it basically the Windows equivalent of riot access. Why does any normal app need root access?
- gruez 8y ago
  maybe back in xp days, which gives administrative access to programs by default. this was mostly fixed since vista
- jfim 8y ago
  The installer needs administrative privileges, the same way that make install needs root to write into /usr/bin.

patrickmn 8y ago

> I have not heard many companies really conceptualize their “supply chain” exposure from the myriad of scripts/dependencies injected via tag managers and other software. I made a thing called "TrackerMap" that allowed people, mostly Fortune 500 web/risk/compliance people, to do just that: https://www.crownpeak.com/products/monitoring-solutions/tag-auditor-with-trackermap https://www.crownpeak.com/products/monitoring-solutions/tag-... (It has since been acquired, and I have no affiliation.)

mjevans 8y ago

The 'supply chain' of docker and other sandboxed 'exact versions' request-able environments scare me. Horrid 'enterprisy' java applications showed everyone how bad things could get and those same mistakes are being replicated instead of learned from.

mey 8y ago

These come to mind for scanning for malicious dependencies https://www.blackducksoftware.com/ https://www.blackducksoftware.com/ https://www.sonatype.com/nexus-firewall https://www.sonatype.com/nexus-firewall I believe there are others, just pulling from memory.

scarface74 8y ago

The article also stated that the malware being a part of an installation utility gave it basically the Windows equivalent of riot access. Why does any normal app need root access?

gruez 8y ago
maybe back in xp days, which gives administrative access to programs by default. this was mostly fixed since vista
jfim 8y ago
The installer needs administrative privileges, the same way that make install needs root to write into /usr/bin.