Piergiorgio Ladisa,Serena Elisa Ponta,Antonino Sabetta,Matias Martinez,Olivier Barais
Abstract:This work discusses open-source software supply chain attacks and proposes a general taxonomy describing how attackers conduct them. We then provide a list of safeguards to mitigate such attacks. We present our tool "Risk Explorer for Software Supply Chains" to explore such information and we discuss its industrial use-cases.
What problem does this paper attempt to address?
### Problems the Paper Attempts to Solve
The paper primarily explores open-source software supply chain attacks and proposes a general taxonomy to describe how attackers carry out these attacks. Additionally, the paper provides a series of protective measures to mitigate the impact of such attacks. Specifically, the paper aims to address the following issues:
1. **Security Issues of Open-Source Software Supply Chain**:
- Open-source software (OSS) is widely used in modern applications, potentially accounting for more than 90% of commercial application code.
- Due to the complexity of modern software supply chains, attackers have multiple opportunities to inject malicious code into open-source components, thereby infecting downstream users.
2. **Fragmentation of Existing Literature**:
- Existing literature lacks a general, technology-agnostic description of how attackers inject malicious code into open-source projects.
- Through a systematic literature review (SLR), the paper collected 370 resources covering real-world attacks and scientific and gray literature, constructing a taxonomy that includes 117 unique attack vectors.
3. **Providing Protective Measures**:
- The paper proposes 33 general protective measures to address the identified attack vectors.
- These protective measures include but are not limited to protecting production branches, removing unused dependencies, version locking, dependency resolution rules, user account management, secure authentication, and using security and quality metrics.
4. **Tool Development and Industrial Application**:
- The paper introduces the "Risk Explorer for Software Supply Chains" tool for exploring the aforementioned information and discusses its industrial application scenarios.
- The tool aims to help users visualize and expand the taxonomy, enhancing awareness and protective capabilities against open-source software supply chain attacks.
### Summary
By constructing a comprehensive taxonomy and providing specific protective measures, the paper aims to improve the security of the open-source software supply chain, reduce the risk of malicious code injection, and provide practical tools and support for both industry and academia.