Taxonomy of Attacks on Open-Source Software Supply Chains - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Taxonomy of Attacks on Open-Source Software Supply Chains

Résumé

The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
Fichier principal
Vignette du fichier
2204.04008.pdf (896.73 Ko) Télécharger le fichier
2204.04008 (1).pdf (896.73 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04423761 , version 1 (29-01-2024)

Licence

Paternité

Identifiants

Citer

Piergiorgio Ladisa, Henrik Plate, Matias Martinez, Olivier Barais. Taxonomy of Attacks on Open-Source Software Supply Chains. SP 2023 - IEEE Symposium on Security and Privacy, May 2023, San Francisco, United States. pp.1509-1526, ⟨10.1109/SP46215.2023.10179304⟩. ⟨hal-04423761⟩
15 Consultations
54 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More