Coverage about supply chain attacks tends to focus on typosquatting issues, fueled by the marketing of security vendors and their FUD. More recently, “Jia Tan” pushed the limits of psychological abuse over two years to become maintainer of xz, enabling them to plant a sophisticated backdoor in the project. These are just isolated incidents on specific packages–yet with the potential to compromise a significant number of users. But what does it take to compromise a whole Linux distribution?
In this talk, we share a much less documented class of attack: the compromise of the infrastructure of open-source projects with fresh 0-days, based on the research that led us finding critical issues in the build systems of Fedora, OpenSUSE and all their downstream distributions like CentOS. After coming back on examples of such attacks in recent history, we dive into Pagure and Open Build Service, two custom applications deployed on their infrastructure. Let’s see where some old-school bugs will lead us!
