Javier Conejo del Cerro

Every software ecosystem resembles a city. Developers construct applications like buildings, dependencies form their foundations, repositories supply the materials, and automated pipelines transport those materials from one construction site to another. The entire city depends on trust. A developer installs a package. A build system executes its installation scripts. A release pipeline publishes a new version. Other projects consume it, assuming the material arriving from a familiar supplier...

Every visitor knows the routine. You approach a building. A security guard stands at the entrance. He wears the right uniform, stands behind an official-looking checkpoint and asks you to complete a routine verification before entering. You comply. After all, the guard is supposed to protect the building. Now imagine the guard is not employed by the building at all. He has stolen the uniform, taken control of the checkpoint and rewritten the instructions. Instead of checking whether you...

Every organization has processes that are supposed to belong there. Security products inspect email. Daemons quietly run in the background. Network appliances process traffic. Most of the time, nobody has a reason to look twice. That is exactly where the penguin bandit wanted to hide. Instead of sneaking through the building wearing a black mask, he dressed like an employee. In South Korea, he borrowed the uniform of SpamSniper. In Taiwan, he hid around ShareTech appliances. Elsewhere, he...