Security Research

im in ur scm, bein a ninja

November 4, 2014

Hank

A few months ago I posted a high-level overview of some source code repository tampering risks.

The other day I presented a much deeper dive at BSides DC, with examples of multiple ways to manipulate CVS, Git, and Subversion repositories, and some thoughts on how companies and code-hosting sites could/should harden their infrastructures.

Watch the presentation, or download the slides. (PDF warning)

Watch for future blog posts that extract and expand upon some of those examples.

Thanks to the BSidesDC folks for a great conference, and to ComputeCycle for the recordings!

Similar Articles

Security Research

Converting IDA PAT to Yara Signatures

One of the issues when analyzing malicious Linux executables occurs when the executable has been statically linked and the debugging symbols stripped. Since the debugging symbols are stripped, IDA Pro is unable to identify the names of the library functions and we are left to determine the names on ...

Nov 14, 2013 Read more

#tools #forensics +1

Security Research

CyberConVA 2025!

Jan 19, 2025 Read more

#networking

Security Research

Hacking Team Documents Claim BIOS-based Persistence

A search through the of the information stolen from Hacking Team shows indications that a BIOS-based infection capability was developed as part of the Remote Control System software. This may be the first time a commercial spyware product claims this type of capability.

Jul 8, 2015 Read more

#tools

All Blog Posts

Get Security Help