Here's the sketch of a defense against such attacks. Is there anyone out there who'd buy it, if it existed? Imagine a tool that given a simple description of a

Here's the sketch of a defense against such attacks. Is there anyone out there who'd buy it, if it existed? Imagine a tool that given a simple description of a server (e.g. pointed at your build system or a downloadable artifact like a container image) creates a VM that starts the app on boot, uploads that VM image to the cloud, starts it up and then performs a remote attestation protocol to verify that the remote VM is running what you think it's running, down to the last byte. Remote attestation allows you to "measure" a VM or enclave to determine a cryptographic hash of everything running on the machine in an auditable way. Sometimes the VM has encrypted RAM so you can prove that the cloud provider can't break into that machine. It could potentially have helped in this case where the attackers compromised a build system. Remote attestations can be chained together and used as signatures, so for example SolarWinds could have come with a proof that it was compiled correctly from a particular git commit hash, and then third party auditors could have been hired to monitor that the code doesn't have backdoors. Customers could then run it and get from this imaginary tool a complete audit chain all the way back to a certificate issued by a third party that says "we reviewed the code at commit <hash> and this program was compiled from that code via a build system audited via remote attestation". Now, RA isn't a silver bullet. It's still possible to transiently hack a machine such that the hack remains in memory. But if you regularly reboot and re-attest your VMs, you can wipe these hacks out on a regular basis because the entire thing is being booted from a known good image, and that image is created from known good code, etc. The pieces already exist. AMD SEV, Intel TDX, Amazon Nitro and others support RA protocols for virtual machines, Linux has support for propagation of attestations through the service stack. But there seems to be a lack of orchestration tools to bring all the parts together. If there's any interest in signing a letter of intent for such a tool please get in touch (email address in profile).