Instrumenting software builds to detect stealth backdoors and other curiosities#

Hilko Bengen

• Why: Post-xz (CVE-2024-3094), detecting build-time tampering is an open supply-chain problem; this is a concrete attempt at build observability rather than signing/provenance paperwork.
• What: A Linux-based prototype toolset that instruments build processes (./configure && make, cargo build, pip install, CI) to generate and analyze lower-level build logs, inferring whether a binary was actually built from the presented sources and detecting abnormal compiler/linker use — with curious findings and limitations discussed. (from abstract only)
• How: Instrumentation of what actually happens during builds, then log analysis for source-to-binary correspondence and anomalous toolchain usage.
• Where applicable: Linux software builds generally; prototype maturity — a research direction and detection idea, not a deployable control.