The Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
summary
A .NET application supply chain walkthrough shows where attacks actually occur: compromised IDEs and extensions, CI/CD build scripts (a VS Code build variable exploit), and malicious third‑party packages (npm event‑stream with 2 million weekly downloads). The demo builds a pipeline, uses in-toto reproducible verification to catch a tampered source file (verification fails), and recommends concrete mitigations: CycloneDX SBOM generation, multi‑factor auth, and git commit signing plus deterministic builds.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:49The Rise of Software Supply Chain Attacks
- 3:38Agenda
- 4:45Hacking History
- 9:02Code Red & SQL Slammer
- 9:46Bill Gates - Email to all MS FTE
- 10:23Changes in Software Architecture
- 11:05What is a Supply Chain?
- 15:12Hacking Hardware
- 18:57Octopus Scanner - NetBeans
- 19:54Visual Studio Code
- 25:01Development Machine
- 28:37Canonical GitHub Account
- 29:32Microsoft GitHub Account
- 30:01Use MFA on source-repository
- 30:46GIT Commit Signing
- 33:25Build / Deployment
- 35:05Twilio SDK
- 36:00Webmin Backdoor
- 36:52SolarWinds Sunspot
- 40:01Reproducable/Deterministic Builds
- 41:28Automotive Industry
- 42:14Car Supply Chain
- 55:05DataDog & In-Toto
- 55:46Azure Pipelines Artifact Policy
- 56:53Conclusion
related talks
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
37mSupply Chain Attacks and the Future of Software Delivery
58mSecuring your .NET application software supply-chain
58mSecuring your .NET application software supply chain
39mSoftware Supply Chain Security
57m.NET supply chain: Protecting against hidden threats
56m.NET supply chain: Protecting against hidden threats
01h 02mProtect Yourself Against Supply Chain Attacks