Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages
summary
Built a large‑scale analysis pipeline that clones ~350,000 repos, parses workflows, runs specialized static checks and stores results in BigQuery then Neo4j, and finds thousands of risky GitHub Actions workflows and injections. The project surfaces ~27,000 modules/providers and dozens of popular Actions with missing permissions, demonstrates an attack that lets an attacker publish a backdoored Terraform module via orphan git tags, and yields ~50 disclosures; releases tools: LOTP, the poutine/Putin scanner and messypoutine CTF.
AI-written summary · about
chapters (9)
- 0:00Supply chain security risks
- 3:50Threat modeling build pipelines
- 12:03GitHub Actions in open source
- 17:25Package Supply scanning 350K repos
- 23:29Attack demo on Terraform modules
- 28:47Fixing vulnerable pipelines
- 30:56Putin static analysis tool
- 38:20Future of CI/CD security
- 39:44Q&A
related talks
17mIs My (Open Source) Project Safe?
44mSecuring CI/CD Pipelines: Exploring Vulnerabilities In Workflows
30mGitHub Actions Security in Python Packages
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
44mSecurity Research with Open Source Software: Vol. Omega
38mThe Risks of Blind Trust in Code from Strangers
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
32mHacking the OSS Supply Chain