SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
复制标题
SoK：开源软件供应链攻击分类
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Olivier Barais
中科院分区：
文献类型：
--
作者：
Piergiorgio Ladisa;H. Plate;Matias Martinez;Olivier Barais
对开放源码软件的广泛依赖使其成为恶意行为者卓有成效的目标，反复发生的攻击就证明了这一点。当今开源供应链的复杂性导致了巨大的攻击面，为攻击者提供了无数机会，以达到将恶意代码注入开源工件，然后由受害者下载并执行的目标。这项工作提出了一个通用的开源供应链攻击分类，独立于特定的编程语言或生态系统，并覆盖从代码贡献到软件包分发的所有供应链阶段。它以攻击树的形式，涵盖了107个独特的向量，与94个真实事件相关联，并映射到33个缓解安全措施。与17位领域专家和134位软件开发人员进行的用户调查积极验证了分类的正确性，全面性和可理解性，以及它对各种用例的适用性。调查参与者还评估了所确定的保障措施的效用和成本，以及是否使用了这些保障措施。
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
登录
查看更多内容
in-toto：为比特和字节提供从农场到餐桌的保证
DOI：
10.5555/3361338.3361435
发表时间：
2019
期刊：
Proc. of the 28th USENIX Security Symposium
影响因子：
--
作者：
Torres-Arias, Santiago;Afzali, Hammad;Kuppusamy, Trishank Karthik;Curtmola, Reza;Cappos, Justin
通讯作者：
Cappos, Justin
DOI：
10.1109/icse43902.2021.00121
发表时间：
2021-03
期刊：
2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)
影响因子：
--
作者：
G. Ferreira;Limin Jia;Joshua Sunshine;Christian Kästner
通讯作者：
G. Ferreira;Limin Jia;Joshua Sunshine;Christian Kästner
影响因子：
3.9
作者：
Kitchenham, Barbara;Brereton, O. Pearl;Linkman, Stephen
通讯作者：
Linkman, Stephen
DOI：
10.1109/icsme46990.2020.00071
发表时间：
2020-05
期刊：
2020 IEEE International Conference on Software Maintenance and Evolution (ICSME)
影响因子：
--
作者：
Pronnoy Goswami;Saksham Gupta;Zhiyuan Li;Na Meng;Daphne Yao
通讯作者：
Pronnoy Goswami;Saksham Gupta;Zhiyuan Li;Na Meng;Daphne Yao