Supply Chain Anarchy - Trojaned Binaries in the Java Ecosystem
summary
Claims an automated pipeline that matches repositories, builds code, and runs a security diff across Java libraries, tolerating compiler noise so only real bytecode differences flag. The experiment builds hundreds of projects, compares produced jars to central repo artifacts, and finds about 11% mismatch between source and distributed binaries. Demonstrates concrete trojan techniques (classloader payloads, backdoored jar replacement, typosquatting) and emphasizes that library code runs with full application privileges.
AI-written summary · about
chapters (4)
related talks
13mKeynote: Hacking the OSS Supply Chain
44mSecuring the Supply Chain for Your Java Applications
39mReflections on Trust in the Software Supply Chain
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
30mSupply Chain Security for OpenSource Projects
14mSupply Chain Security, why should I care?
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks