Speaker
Alexandre Bartel
(Umeå University)
Description
Software supply chain attacks can rely on multiple vectors, targeting the different stages of the software lifecycle from compromizing the build servers to social engineering on developers. After an overview of these techniques, we discuss an approach which introduces stealthy code changes to activate individual gadgets. In the context of Java deserialization, these gadgets could be combined to form full chains leading to RCE. We present empirical insights into the prevalence of such an attack vector in real code bases. Identifying code locations where gadgets can be introduced is the first step to prevent such supply chain attacks.
| Length | 45 minutes |
|---|
Author
Alexandre Bartel
(Umeå University)