Practice 03

Binary & Supply Chain Security

What ships is a binary, not a repository. We analyse the artefact: static and dynamic reverse engineering, coverage-guided and directed fuzzing, binary-level SBOM recovery, and provenance that a downstream verifier can check without trusting us.

Engagement parameters

TargetsFirmware · drivers · TEE · WASM runtimes · mobileToolingGhidra · IDA · AFL++ · LibAFL · syzkaller · angrFormatsSPDX 3.0 · CycloneDX 1.6 · VEX · in-toto · SLSADeliverablesAttack surface map · crash corpus · SBOM/VEX · provenance policy

Data sheet · A4 · SP-SVC-03Open PDF sheet

Reverse engineering · SP-SVC-03.01

Firmware & binary analysis

Ghidra and IDA with in-house lifters for MIPS, ARM Cortex-M/R/A, RISC-V and PowerPC. Bootloader and secure-boot chain review, TrustZone / TEE attack surface, debug-interface and glitching resistance. Deliverable: an annotated attack surface map, not a listing.

Fuzzing · SP-SVC-03.02

Coverage-guided & directed fuzzing

AFL++ and LibAFL harnesses, kernel fuzzing with syzkaller, firmware rehosting for interrupt-driven targets (AidFuzzer-class techniques), differential fuzzing of parsers — the ZipDiff approach found ambiguities in 50 ZIP parsers across 19 languages. Crash triage to root cause with CWE and exploitability verdict.

SBOM · VEX · SP-SVC-03.03

Software bill of materials

SPDX 3.0 and CycloneDX 1.6 SBOMs generated from the built artefact — recovered from the binary and reconciled against the manifest, because the two disagree more often than not. VEX statements so a CVE in a vendored library reads not affected when the path is unreachable. Meets CRA and EO 14028 delivery requirements.

Provenance · SP-SVC-03.04

Reproducible builds & attestation

Bit-for-bit reproducible builds, SLSA Build L3 provenance, Sigstore keyless signing with Rekor transparency, in-toto attestations across the pipeline. A verifier at the consumer end can check the chain without calling you.

Third-party · SP-SVC-03.05

Vendor & OSS component review

Pre-acquisition and pre-deployment analysis of closed-source appliances, mobile SDKs and OSS dependencies. Typosquat and maintainer-takeover monitoring; xz-utils-style backdoor patterns in build scripts caught by diffing release tarballs against tagged source.

Hardening · SP-SVC-03.06

Binary hardening verification

CFI, PAC/BTI, CET, stack canaries, RELRO, ASLR entropy — measured on the shipped binary, not declared in the build flags. Memory-safety migration planning for the components where the bug class keeps recurring.

Operators · identities withheld

Named to clients under NDA at scoping

OP-03

Principal · vulnerability research

Name withheld · active CVD embargoes

Firmware

Browser

HSM

OP-07

Lead · detection engineering

Name withheld · client SOC placement

Streaming ML

Sigma

DFIR

OP-11

Senior · cryptographic engineering

Name withheld · government PKI programme

HSM ceremonies

PQC

Formal verification

OP-14

Network engineer · AS216096

Name withheld · NOC rotation

BGP

RPKI

Dark fibre

Architectures with in-house lifters

48h

Crash to root-cause triage, median

SLSA L3

Provenance level delivered

100%

SBOMs reconciled against the binary