Tracing Code Lineage: Using OSINT to Illuminate the Origins of Open Source Software
4As open-source software (OSS) has become an integral part of modern digital infrastructures, ensuring its authenticity and understanding its origins are critical for mitigating supply chain risks. The diverse and often opaque origins of OSS components leave organizations vulnerable to tampered code, malicious actors, and unvetted dependencies, all of which can serve as entry points for sophisticated supply chain attacks.
This talk explores the dual concepts of provenance and pedigree within open source software, applying OSINT techniques to trace not only the origins but also the lineage of software components. By analyzing the history of contributors, changes, and project governance, security professionals can better assess the trustworthiness of the code they rely on.
We will demonstrate how OSINT can expose hidden risks in software, identifying suspicious patterns and contributors. This becomes especially important as we explore newer regulatory pushes to eliminate adversarial contributions in our supply chains in the pursuit of national security interests.
Lastly, we will map these techniques to real-world supply chain attack scenarios, leveraging frameworks like the SAP Risk Explorer for Software Supply Chains to highlight potential exploitation pathways.
Key Takeaways:
-OSINT-driven methods for tracing the provenance and pedigree of open source software.
-Techniques for identifying risky contributors and exploration of attribution challenges and Title 10 restrictions for US government agencies.
-How to map these risks to broader supply chain attack scenarios and approaches to distinguish normal adversarial activity from malicious actions.
-This session will equip cybersecurity and technical supply chain security practitioners with the tools and techniques to understand the supply chain threat landscape and apply OSINT in their mission to secure their organizations.
View upcoming Summits: http://www.sans.org/u/DuS
SANS Open-Source Intelligence Summit 2025
Tracing Code Lineage: Using OSINT to Illuminate the Origins of Open Source Software
Tony Turner