Software supply chain transparency

Software supply chains have become a central pillar of modern software development practices. While the underlying concept offers substantial advantages - meeting today’s complex requirements for efficiency, consistency, and automation - it also increases the attack surface and introduces an evolving threat landscape, making supply chain attacks increasingly attractive to adversaries. This thesis presents new approaches to mitigate still existing threats targeting the software supply chain by introducing and enhancing existing protocols, leveraging existing security controls in novel ways, and, most importantly, increasing transparency to make malicious attempts to compromise software supply chains easier to detect. We begin by examining threats to the software distribution stage - the point at which artifacts (e.g., mobile apps) are delivered to end users - with an emphasis on mobile ecosystems. A major security objective is to ensure authenticity and integrity of the artifact, which is commonly achieved by using digital signatures. However, singing keys can be lost, stolen, or abused to sign potentially malicious updates of an artifact. To address these threats, we introduce a new protocol that makes unauthorized distribution attempts verifiable and transparent to both developers and end users. Ultimately, the secure operation of these applications depends on a trustworthy foundation - the operating system. Accordingly, we next focus on the operating system on mobile devices, with an emphasis on mitigating bootloader-targeted attacks. We demonstrate how to compensate lost security guarantees on devices with an unlocked bootloader. This allows users to flash custom operating systems on devices that no longer receive security updates from the original manufacturer without compromising security. We then move to the source code stage. To better understand supply chain attacks at the source code level, we analyzed a recent attempt to implant a backdoor in an open-source project. This analysis allowed us to identify key takeaways of the adversaries‘ critical attack path and based on these learnings to propose new crawling methods that identify potential indicators of compromise in open-source projects. Modern software development practices, however, extend beyond source code; nowadays, development teams often rely on external infrastructure provided by potentially untrusted cloud server providers. To mitigate the associated threats (e.g., insider attacks on the external infrastructure), we introduce a new architecture to ensure strong source-to-binary correspondence by leveraging the security guarantees of Confidential Computing technology. Finally, we present The Supply Chain Game, an organizational security approach that enhances standard risk-management methods. We demonstrate how game-theoretic techniques, combined with common risk management practices, can derive new criteria to better support decision makers.