The Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
summary
Shows concrete supply‑chain failures (npm event-stream, XcodeGhost, Twilio SDK, stolen git credentials and a 500 GB Microsoft leak) and demonstrates tools that detect tampering: builds use .NET reproducible settings and an in-toto layout that signs developer/publisher steps, then a manipulated package fails verification. Recommends producing a software bill of materials (CycloneDX), enabling MFA, and treating build agents, container images and SDK mirrors as high‑risk, not just code.
AI-written summary · about
chapters (32)
- 0:00Intro
- 1:24The Rise of Software Supply Chain Attacks
- 2:09Agenda
- 3:24Hacking History
- 4:05Getting connected!
- 5:25Smashing the Stack...
- 5:57SQL Injection
- 6:32Code Red & SQL Slammer
- 7:21Bill Gates - Email to all MS FTE
- 7:45Changes in Software Architecture
- 9:38What is a Supply Chain?
- 14:43Hacking Hardware
- 18:16Octopus Scanner - NetBeans
- 19:39Visual Studio Code
- 23:42Development Machine
- 26:49Canonical GitHub Account
- 27:38Microsoft GitHub Account
- 28:05Use MFA on source-repository
- 28:42GIT Commit Signing
- 29:37EvenStream NPM
- 31:19Build / Deployment
- 32:22XCode Ghost
- 33:31Twilio SDK
- 34:20Webmin Backdoor
- 37:00Reproducable/Deterministic Builds
- 40:02Automotive Industry
- 41:07Car Supply Chain
- 43:22Software Bill of Materials (SBOM)
- 46:17In-Toto - Demo - Terminology
- 54:22DataDog & In-Toto
- 55:14Azure Pipelines Artifact Policy
- 55:38Conclusion
related talks
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
41mHow to protect your software project from supply chain security threats
37mSupply Chain Attacks and the Future of Software Delivery
36mBuilding a Trusted and Resilient Software Supply Chain
39mSoftware Supply Chain Security
58mSecuring your .NET application software supply-chain
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
41mManaging the Risk of Software Supply Chain Attacks