Abstract:The SolarWinds attack that exploited weaknesses in the software update mechanism highlights the critical need for organizations to have better visibility into their software dependencies and potential vulnerabilities associated with them, and the Software Bill of Materials (SBOM) is paramount in ensuring software supply chain security. Under the Executive Order issued by President Biden, the adoption of the SBOM has become obligatory within the United States. The executive order mandates that an SBOM should be provided for all software purchased by federal agencies. The main applications of SBOMs are vulnerability management and license management. This work presents an in-depth and systematic investigation into the integrity of SBOMs. We explore different attack vectors that can be exploited to manipulate SBOM data, including flaws in the SBOM generation and consumption phases in the SBOM life cycle. We thoroughly investigated four SBOM consumption tools and the generation process of SBOMs for seven prominent programming languages. Our systematic investigation reveals that the tools used for consumption lack integrity control mechanisms for dependencies. Similarly, the generation process is susceptible to integrity attacks as well, by manipulating dependency version numbers in package managers and additional files, resulting in incorrect SBOM data. This could lead to incorrect views on software dependencies and vulnerabilities being overlooked during SBOM consumption. To mitigate these issues, we propose a solution incorporating the decentralized storage of hash values of software libraries.

SolarWinds and the Challenges of Patching: Can We Ever Stop Dancing With the Devil?

SolarWinds Software Supply Chain Security: Better Protection with Enforced Policies and Technologies

Software Supply Chain Attacks, a Threat to Global Cybersecurity: SolarWinds’ Case Study

On SolarWinds Orion Platform Security Breach

A review of SolarWinds attack on Orion platform using persistent threat agents and techniques for gaining unauthorized access

S3C2 Summit 2023-11: Industry Secure Supply Chain Summit

To Patch, or not To Patch? That is the Question: A Case Study of System Administrators' Online Collaborative Behaviour

Journey to the Center of Software Supply Chain Attacks

Better Call Saltzer \& Schroeder: A Retrospective Security Analysis of SolarWinds \& Log4j

Supply Chain Insecurity: The Lack of Integrity Protection in SBOM Solutions

Are Software Updates Useless Against Advanced Persistent Threats?

Top Five Challenges in Software Supply Chain Security: Observations From 30 Industry and Government Organizations

S3C2 Summit 2023-06: Government Secure Supply Chain Summit

Understanding vulnerabilities in software supply chains

Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

Known Vulnerabilities of Open Source Projects: Where Are the Fixes?

A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda

Vulnerabilities and Security Patches Detection in OSS: A Survey

Enterprise-Driven Open Source Software: A Case Study on Security Automation

Insecure by Design in the Backbone of Critical Infrastructure

What is Software Supply Chain Security?