Security Now Examines Home Depot Token Exposure and Open-Source Package Risks

Summary

Security Now discusses a revoked Home Depot access token, malicious open-source package trends, Windows Smart App Control tradeoffs and a report on risks to the US power grid from Chinese-made equipment.

Key points

• Researcher Ben Zimmerman said an exposed Home Depot employee token provided write access to hundreds of private GitHub repositories and access to cloud systems. He said it was revoked after TechCrunch contacted the company.
• The speakers said it was unknown whether anyone else used the Home Depot token while it was exposed.
• Gibson reported that Windows Smart App Control blocked some customized benchmark downloads and cautioned that turning it off cannot be reversed without a fresh Windows 11 installation.
• The show cited an 86.8% year-over-year increase in malicious package submissions and described obfuscation, installation-time execution and dynamically fetched payloads as analysis challenges.
• A Strider Intelligence report cited by the show raised concerns about remotely controllable Chinese-made inverter equipment used by US utilities. Its findings do not establish that the equipment was compromised.