https://arxiv.org/abs/2204.04008

close this message
arXiv smileybones icon

Global Survey

In just 3 minutes, help us better understand how you perceive arXiv.
Take the survey

TAKE SURVEY
Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arxiv logo > cs > arXiv:2204.04008
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2204.04008 (cs)
[Submitted on 8 Apr 2022]

Title:Taxonomy of Attacks on Open-Source Software Supply Chains

Authors:Piergiorgio Ladisa, Henrik Plate, Matias Martinez, Olivier
Barais
Download PDF

    Abstract: The widespread dependency on open-source software makes
    it a fruitful target for malicious actors, as demonstrated by
    recurring attacks. The complexity of today's open-source supply
    chains results in a significant attack surface, giving attackers
    numerous opportunities to reach the goal of injecting malicious
    code into open-source artifacts that is then downloaded and
    executed by victims.
    This work proposes a general taxonomy for attacks on open-source
    supply chains, independent of specific programming languages or
    ecosystems, and covering all supply chain stages from code
    contributions to package distribution. Taking the form of an
    attack tree, it covers 107 unique vectors, linked to 94
    real-world incidents, and mapped to 33 mitigating safeguards.
    User surveys conducted with 17 domain experts and 134 software
    developers positively validated the correctness,
    comprehensiveness and comprehensibility of the taxonomy, as well
    as its suitability for various use-cases. Survey participants
    also assessed the utility and costs of the identified safeguards,
    and whether they are used.

Subjects: Cryptography and Security (cs.CR)
Cite as:  arXiv:2204.04008 [cs.CR]
          (or arXiv:2204.04008v1 [cs.CR] for this version)
          https://doi.org/10.48550/arXiv.2204.04008
          Focus to learn more
          arXiv-issued DOI via DataCite

Submission history

From: Piergiorgio Ladisa [view email]
[v1] Fri, 8 Apr 2022 11:37:24 UTC (10,494 KB)
Full-text links:

Download:

  * PDF
  * Other formats

[by-sa-4]
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2204
Change to browse by:
cs

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code & Data

Code and Data Associated with this Article

[ ] arXiv Links to Code Toggle
arXiv Links to Code & Data (What is Links to Code & Data?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs and how to get involved.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack