News for hackers. Stuff that matters.

A comment on Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies. Parent comment

Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by geek_at on Wednesday February 10, 2021 @05:10AM (#26087406)
I'm more amazed by the fact that they got bounties because the attack wouldn't be (easily) possible without insider knowledge on which dependencies their internal build system used
[ Parent | on HN ]
Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by knowhy on Wednesday February 10, 2021 @05:17AM (#26087447)
> To test this hypothesis, Birsan began hunting for names of private internal packages that he could find in manifest files on GitHub repositories or in CDNs of prominent companies but did not exist in a public open-source repository.

If I'm not mistaken insider knowledge wasn't necessary.

[ Parent | on HN ]
Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ... by geek_at on Wednesday February 10, 2021 @06:58AM (#26088089)
my mistake
[ Parent | on HN ]