The Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries
summary
Compiled binaries routinely contain 47 hidden components including 14 statically linked libraries, 3 vendored libs, 30 build‑time injections that SBOMs and RPMs miss; examples show OpenSSL compiled into a Python shared object (reported 3.0.0 while RPM shows 3.0.7) and rsync bundling an old zlib copy. Practical detection uses binary composition analysis with tools like Binwalk/unblob/strings plus ELF header and symbol inspection to map code back to versions.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:28Why binary dependencies matter
- 3:14Hidden dependency examples
- 8:47Four build decision points
- 14:25Manual binary analysis
- 20:05Building a security team
- 23:10Developer practices to reduce risks
- 24:36Leadership investment
- 26:41SBOMs and build flags
- 28:07Trust dependency manifests
- 29:08Static linking risks
- 30:32Why binary analysis now
- 32:37NetRise solutions
- 33:18Q&A
related talks
18mIT Security – Don’t let Open Source Software become the next menace
39mReflections on Trust in the Software Supply Chain
37mThe State of Open Source Security
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
24mDependency Track Fortifying The Supply Chain
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
33mYour Silent Software Saboteur: Open Source Malware
42mHacking the OSS Supply Chain