论文标题
对开源软件供应链的攻击分类法
Taxonomy of Attacks on Open-Source Software Supply Chains
论文作者
论文摘要
对开源软件的广泛依赖性使其成为恶意角色的富有成果的目标，如经常性攻击所证明的那样。当今的开源供应连锁店的复杂性导致了巨大的攻击表面，这为攻击者提供了许多机会，以实现将恶意代码注入开源工件，然后由受害者下载和执行。 这项工作提出了对开源供应链的攻击，独立于特定的编程语言或生态系统的一般分类法，并涵盖了从代码贡献到包装分配的所有供应链阶段。采用攻击树的形式，它涵盖了107个独特的向量，链接到94起现实世界事件，并映射到33个缓解保障措施。 用户调查与17个领域专家和134个软件开发人员进行了积极验证，分类法的正确性，全面性和可理解性以及对各种用例的适用性。调查参与者还评估了已确定的保障措施的效用和成本，以及是否使用了它们。
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today's open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims. This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards. User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
