Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

The Story of a Novel Supply Chain Attack

Image for post
Image for post
pip install package_name
Image for post
Image for post
Image for post
Image for post

The Idea

Image for post
Image for post

“It’s Always DNS”

Image for post
Image for post

The More The Merrier

Image for post
Image for post

Results

Image for post
Image for post

“It’s Not a Bug, It’s a Feature”

Image for post
Image for post

Future Research?

Shout-outs

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store