Protecting Your Organization from Build-system Attacks
summary
The talk explains how build systems and artifact repositories can be attack vectors (citing CCleaner and SolarWinds) and reviews concrete defenses in the Java/Gradle ecosystem. It covers Gradle features like dependency verification (checksums and PGP signatures, SHA‑256/SHA‑512 by default since Gradle 6.x), improved allowlists in Gradle 7.4, and operational practices such as requiring TLS+authentication for remote build caches and CI images, using reproducible builds, and running ephemeral CI to limit persistence and impact.
AI-written summary · about
chapters (16)
- 0:00Start
- 4:18CCleaner/Asus in 2018
- 5:34Homebrew - 30 minutes from nobody to a commit
- 8:25Dependency trust is a risk
- 10:34Real-world dependency graph (Java)
- 11:00A confusing dependency in 2018
- 14:41JVM Application building: Potential attack vectors
- 16:09Compromising OSS developer machines
- 23:43Mitigating performance issues
- 34:55Inconsistent repositories
- 36:17GitHub package registry
- 38:09Repository filtering with Gradle
- 39:12Dealing with vulnerable dependencies
- 40:21Gradle wrapper checksum verification
- 41:24A word about 3rd-party distributions
- 43:13Reproducible builds
related talks
51mProtecting your organisation against attacks via the build system
37mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
36mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
38mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
41mPreparing for Supply Chain Attacks
30mHow Secure Is Your Build/Server?
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
41mHow to protect your CI/CD from a Supply chain attack?