Build Code is Still Code: Finding the Antidote for Pipeline Poisoning

TL;DR

This paper introduces Foreman, a novel approach and tool for detecting poisoned build systems in software development pipelines, addressing a critical security gap in supply chain protection.

Contribution

It proposes development phase isolation to model build system permissions and demonstrates its effectiveness in detecting poisoned build files, advancing supply chain security.

Findings

Foreman successfully detected poisoned build files in the XZ Utils attack

Development phase isolation effectively models build system permissions

Future work will automate checks for development phase isolation

Abstract

Open source C code underpins society's computing infrastructure. Decades of work has helped harden C code against attackers, but C projects do not consist of only C code. C projects also contain build system code for automating development tasks like compilation, testing, and packaging. These build systems are critcal to software supply chain security and vulnerable to being poisoned, with the XZ Utils and SolarWinds attacks being recent examples. Existing techniques try to harden software supply chains by verifying software dependencies, but such methods ignore the build system itself. Similarly, classic software security checkers only analyze and monitor program code, not build system code. Moreover, poisoned build systems can easily circumvent tools for detecting program code vulnerabilities by disabling such checks. We present development phase isolation, a novel strategy for hardening build systems against poisoning by modeling the information and behavior permissions of build automation as if it were program code. We have prototyped this approach as a tool called Foreman, which successfully detects and warns about the poisoned test files involved in the XZ Utils attack. We outline our future plans to protect against pipeline poisoning by automatically checking development phase isolation. We envision a future where build system security checkers are as prevalent as program code checkers.