Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers

Hossein Siadati, Sima Jafarikhah, Elif Sahin, Terrence Brent Hernandez, Elijah Lorenzo Tripp, Denis Khryashchev, Amin Kharraz

TL;DR

This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software within the realm of the SSC.

Abstract

The Software Supply Chain (SSC) has captured considerable attention from attackers seeking to infiltrate systems and undermine organizations. There is evidence indicating that adversaries utilize Social Engineering (SocE) techniques specifically aimed at software developers. That is, they interact with developers at critical steps in the Software Development Life Cycle (SDLC), such as accessing Github repositories, incorporating code dependencies, and obtaining approval for Pull Requests (PR) to introduce malicious code. This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software. By analyzing a diverse range of resources, which encompass established academic literature and real-world incidents, the paper systematically presents an overview of these manipulative strategies within the realm of the SSC. Such insights prove highly beneficial for threat modeling and security gap analysis.

DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers

TL;DR

This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software within the realm of the SSC.

Abstract

The Software Supply Chain (SSC) has captured considerable attention from attackers seeking to infiltrate systems and undermine organizations. There is evidence indicating that adversaries utilize Social Engineering (SocE) techniques specifically aimed at software developers. That is, they interact with developers at critical steps in the Software Development Life Cycle (SDLC), such as accessing Github repositories, incorporating code dependencies, and obtaining approval for Pull Requests (PR) to introduce malicious code. This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software. By analyzing a diverse range of resources, which encompass established academic literature and real-world incidents, the paper systematically presents an overview of these manipulative strategies within the realm of the SSC. Such insights prove highly beneficial for threat modeling and security gap analysis.
Paper Structure (17 sections, 2 figures, 2 tables)

This paper contains 17 sections, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Software Supply Chain Security
  3. Software Supply Chain
  4. Software Supply Chain Attacks
  5. Scope of work
  6. Research Methodology
  7. Social Engineering Techniques in SSC Attacks
  8. Account Compromise
  9. Device Compromise
  10. Malicious Pull Requests
  11. Malicious Dependency Watering hole
  12. Malicious Code Snippet Watering hole
  13. Entering the Rank of Maintainers
  14. Analysis
  15. Discussions
  16. ...and 2 more sections

Figures (2)

  • Figure 1: Software Supply Chain steps and threats based on documentations of SLSA framework slsa
  • Figure 2: Example interactions between software developers and Software Development Life Cycle (SDLC) critical steps