Instrumenting Software Builds To Detect Stealth Backdoors And Other Curiosities

The talk addresses supply chain attacks, where a build can be altered in ways that never appear in the source code or the final binary. The speaker builds on an idea from a conference talk about Debian packaging and applies it at the level of the build itself. While a build runs, the approach records which processes read and write which files, then links those relationships into a graph that runs from the finished artifact back to its sources.

Using the GNU Hello package as an example, the talk shows how many compiler, assembler and archive steps even a trivial program goes through, which makes the graph messy quickly. Only a few kinds of events are needed: file opens for reading and writing, some renames, and process creation. eBPF probes make this practical with low overhead, whereas LD_PRELOAD fails on statically linked tools and strace is too costly. Applied to the XZ backdoor, the method would have flagged an object file that no compiler produced and a source file patched during the build. It also exposed race conditions in OCaml builds that compile bytecode and native variants in parallel.

The tooling is not yet published. Planned releases include a watcher tool, scripts with signatures for spotting anomalies in the graph, and possible CI integration. In questions, an audience member asked how this differs from nm, which lists symbols but not how files entered a build. The speaker noted that reproducible builds efforts could benefit, and described the work as still in its early stages.