Change management and the four-eyes rule

Graduate · enrolled learners

This lesson opens with Ledger Connect Kit supply-chain compromise, December 2023.

What happened

On 14 December 2023 an attacker phished a former Ledger employee whose npm publishing access had never been revoked, obtained that credential, and published malicious versions of Ledger's Connect Kit, a small JavaScript library that most decentralized applications integrating it loaded at runtime from a CDN to let users connect their wallets. The malicious versions carried a wallet drainer: any user who connected a wallet on a site pulling the poisoned library could be prompted into transactions that emptied it. Because the library was loaded at runtime from a content delivery network, the bad version reached every site using it with no action by the site, and more than 600,000 dollars was drained in a window Ledger puts at under two hours; the poisoned file was live for about five hours in all, and Ledger deployed a genuine fix within 40 minutes of becoming aware. The technical vulnerability was ordinary phishing, but the reason a single phished credential could ship code to every application that loaded it was the absence of change management: one account could publish to production with no independent second reviewer approving the release, and that account still belonged to someone who had left.

The decision point

A production system is only as controlled as the process for changing it, and a change is any new version of code, configuration, dependency, or access that goes live. Change management is the discipline that no such change ships on a single person's authority: the core control is the four-eyes rule, that a second independent person reviews and approves a change before it reaches production, so that one compromised or malicious actor cannot ship alone. Ledger's Connect Kit failed at exactly this point, one phished credential published to every application that loaded it with no second set of eyes on the release, and the failure compounded because the credential belonged to a former employee whose access had never been revoked, which is the access half of the same discipline. The decision is to treat every path that can change production, an npm publish as much as a database migration, as a change that requires an independent approval and an access list that is revoked the day someone leaves, because a change that one person can ship alone is a change one compromised person can ship alone.

Recorded loss

$600,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.