Is a Kessler Syndrome for software a risk worth acknowledging? – Key Discussions

window.dataLayer = window.dataLayer || [];<br>function gtag(){dataLayer.push(arguments);}<br>gtag('js', new Date());

gtag('config', 'G-9CPP2EXYQQ');

-->

Skip to content

The Kessler Syndrome is a scenario where the density of objects and space debris in low Earth orbit becomes so high that collisions between them trigger a runaway chain reaction. Each crash generates thousands of new fragments, exponentially increasing the risk of further impacts and potentially rendering Earth’s orbit unusable.

Because of the rise in supply chain attacks, for months, I think a lot of us have been mulling how project dependencies are far more of a liability than ever before.

Most of us have hopefully been double-checking "min-release-age=" and "ignore-scripts" configurations, and perhaps even switching package managers. (Some languages even lack popular package managers that have these basic affordances.) We also all have to keep a closer eye on dropping CVEs for projects because a) Mythos-class models have upped the number of CVEs dropping, b) AI tools have made it easier for black hats to reverse engineer patches and turn them into exploits.

Just counting some of the high profile examples of public repos being laced with malware lately: Microsoft just disabled 70+ of their own repos, including Azure building tools, because they had been laced with malware. Repos from RedHat, tanstack, axios, Mistral, UiPath, and many other lower profile targets have been hacked. The list is long, and is much longer if you count companies (not just public repos for devs) that have been bitten, including names like GitHub, Cisco, OpenAI, and more.

There are a few things at play: 1) AIs [or fancy new systems, probably made with AI] appear to have dramatically lowered the amount of time to first utilization of stolen credentials. 2) continuous integration/deployment workflows were poorly thought out but cargo culted into mainstream, leaving doors open for worms. 3) For every developer refining/reviewing best practices, there are 20 who are not and, if/when infected, may remain compromised indefinitely, and therefore remain contagious. 4) Cutting edge attack techniques themselves are being shared widely on forums by groups like TeamPCP.

It takes too long to clean an infected system/network (and the malware is getting much smarter/vindictive about detecting its removal, further complicating things), and it takes almost no time for a batch of stolen credentials to be exploited -> new networks traversed, leading to more secrets (that likely compromise more projects, rinse and repeat).

With the recent supply chain attacks a lot of focus was deservedly on the front end tactics of the attack, taking advantage of scripts that automatically run as part of CI/CD workflows. [It is my opinion that providers like GitHub even break/redesign some of these workflows if necessary to protect the community/slow the spread of worms.]

However, I think the much bigger deal is the fact that humans are not needed in the loop in the orchestration of ongoing, chained, personalized-to-the-victim supply chain attacks (to the extent they are, it’s a "nice to have" not a "need to have"). Furthermore, nationstate hackers are well backed (if only through the success of ransomware and crypto project draining. They can buy access to a ton of tokens to run these attacks, either through a cheap API from a less safety minded provider, probably Chinese, or buy their own GPU clusters and run open source models, especially if they have state backing.

I think there is the very real possibility that we reach a Kessler Syndrome situation for shared/open source software, where the success of continued credential stealing campaigns permanently compromises medium, large, and even small networks, and lowers trust in shared software to a crippling degree. I think confidence will erode to a point where we reimplement libraries on the basis of security alone (even more than we are already), which, of course, will make us all more dependent on AI tools.

The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.<br>byu/johnypita inClaudeAI

About and Selected Writings - expand

I'm an editor at Techmeme, a consultant at DiMare Dailey Studio,<br>and the developer of the Mac app CurrentKey.<br>You can find me on Bluesky,<br>Mastodon,<br>and LinkedIn.

Selected Writings

Companies embracing SMS for account logins should be blamed for SIM-swap attacks

451 upvotes on Hacker News

In 2019, Apple needs to change iPhone call UI because robocalls are killing us

15.7K upvotes on Reddit<br>and 268 upvotes on Hacker News

Despite the prevalence of deepfake audio tech, banks and ISPs rush ahead with voice print authentication

120 upvotes on r/privacy. Written in...