DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2024
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866912047656075264 |
|---|---|
| author | Siadati, Hossein Jafarikhah, Sima Sahin, Elif Hernandez, Terrence Brent Tripp, Elijah Lorenzo Khryashchev, Denis Kharraz, Amin |
| author_facet | Siadati, Hossein Jafarikhah, Sima Sahin, Elif Hernandez, Terrence Brent Tripp, Elijah Lorenzo Khryashchev, Denis Kharraz, Amin |
| contents | The Software Supply Chain (SSC) has captured considerable attention from attackers seeking to infiltrate systems and undermine organizations. There is evidence indicating that adversaries utilize Social Engineering (SocE) techniques specifically aimed at software developers. That is, they interact with developers at critical steps in the Software Development Life Cycle (SDLC), such as accessing Github repositories, incorporating code dependencies, and obtaining approval for Pull Requests (PR) to introduce malicious code. This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software. By analyzing a diverse range of resources, which encompass established academic literature and real-world incidents, the paper systematically presents an overview of these manipulative strategies within the realm of the SSC. Such insights prove highly beneficial for threat modeling and security gap analysis. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_18401 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers Siadati, Hossein Jafarikhah, Sima Sahin, Elif Hernandez, Terrence Brent Tripp, Elijah Lorenzo Khryashchev, Denis Kharraz, Amin Software Engineering Cryptography and Security computer security, phishing, software supply chain D.4.6; E.3 The Software Supply Chain (SSC) has captured considerable attention from attackers seeking to infiltrate systems and undermine organizations. There is evidence indicating that adversaries utilize Social Engineering (SocE) techniques specifically aimed at software developers. That is, they interact with developers at critical steps in the Software Development Life Cycle (SDLC), such as accessing Github repositories, incorporating code dependencies, and obtaining approval for Pull Requests (PR) to introduce malicious code. This paper aims to comprehensively explore the existing and emerging SocE tactics employed by adversaries to trick Software Engineers (SWEs) into delivering malicious software. By analyzing a diverse range of resources, which encompass established academic literature and real-world incidents, the paper systematically presents an overview of these manipulative strategies within the realm of the SSC. Such insights prove highly beneficial for threat modeling and security gap analysis. |
| title | DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers |
| topic | Software Engineering Cryptography and Security computer security, phishing, software supply chain D.4.6; E.3 |
| url | https://arxiv.org/abs/2402.18401 |