Speaker
Description
Modern embedded Linux build systems such as Yocto and Buildroot rely on complex pipelines that reuse intermediate artifacts and external inputs. While this improves performance and reproducibility, it also creates opportunities for supply chain attacks that are difficult to detect.
This talk demonstrates practical attack vectors targeting build systems at different stages of the pipeline. First, we show how intermediate object files produced by make in Buildroot can be tampered with during the build process, resulting in compromised binaries without modifying upstream source code. Next, we explore how shared state (sstate) cache artifacts in Yocto can be poisoned, allowing malicious code to propagate across builds through trusted cache reuse.
We demonstrate these attacks end-to-end by injecting malicious behavior into binaries and executing them in a final Linux image under QEMU, illustrating how such compromises can evade traditional verification mechanisms.
We then present mitigation strategies, focusing on signing and verification of sstate artifacts to establish trust in reused build outputs. Integration points and tradeoffs between security, performance, and reproducibility are discussed.
This session provides a practical look at real-world build system attacks and concrete techniques to harden them. It is aimed at developers and maintainers of build systems, embedded Linux distributions, and toolchains who are concerned with supply chain security.