Imagine finding an exploit in the biggest supply chain companies around the world and being able to simply breach into every one of them. Well, that's what Alex Birsan did.
Don't fret, he's a security researcher who notified the companies, including Apple, Microsoft, Netflix, PayPal and more than 30 other companies, about his findings. In fact, he got bounty payments of up to $40,000 each for his efforts. Nicely done.
- Stay protected with the best VPN services of 2021
- Check out the best laptops of 2021
- Here are the best gaming laptops available right now
The security researcher hacked into a list of supply chain companies by exploiting a vulnerability he calls 'Dependency Confusion', in which he used fake packages named like internal private packages to sneak in (a very basic explanation, mind you). Birsan's packages had no code in them, only a disclaimer stating, "this package is meant for security research purposes and does not contain any useful code" (via Bleeping Computer).
"From one-off mistakes made by developers on their own machines, to misconfigured internal or cloud-based build servers, to systemically vulnerable development pipelines, one thing was clear: squatting valid internal package names was a nearly sure-fire method to get into the networks of some of the biggest tech companies out there, gaining remote code execution, and possibly allowing attackers to add backdoors during builds," said Birsan on his article on The Medium.
Apple explained that remote code execution on Apple servers would have worked with Birsan's npm package technique, paying him a nifty $30,000 as a reward. Apple fixed the bug over a span of two weeks however other companies such as Shopify fixed the issue within a day.
According to Birsan's article, he had at least been awarded $130,000 in bug bounties, stating that “the majority of awarded bug bounties were set at the maximum amount allowed by each program’s policy, and sometimes even higher.” Bug bounties are rewards for those who find bug within their system, and it looks like Birsan hit the jackpot.
The article goes into further detail about how he breached the companies using private and public file packages that's definitely worth the read. If all this hacking has you worried, some of the best VPN services today could fix that.
