Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth
Study shows open-source SBOM tools only cover structural exposure and vulnerability presence, missing code reachability and taint-path analysis stages.
An arXiv paper proposes a four-stage propagation model for software supply chain attack effects and empirically evaluates four open-source SBOM tools against it using three projects and the Log4j vulnerability as the test case. Current SBOM tools systematically support only Stage 1 (structural exposure) and Stage 2 (vulnerability class presence), while Stage 3 (code reachability) and Stage 4 (taint path analysis) require capabilities absent from the SBOM ecosystem. The authors argue propagation-centred SSC security research is needed to prevent cyber risk from evolving into systemic risk.
- Four-stage propagation model: structural exposure, vulnerability presence, code reachability, taint path analysis
- Four open-source SBOM tools evaluated on three projects using Log4j as test case
- SBOM ecosystem lacks reachability and taint-path capabilities for exploitability propagation
- Authors urge propagation-centred SSC research to avert systemic cyber risk
From the original article
1 min read at arxiv.orgEnsuring security of software supply chains (SSC) is indispensable in today's world of modern software practices. SBOM (tools) have been introduced as relevant building blocks to ensure the transparency of SSCs. However they have serious limitations in practices as their vulnerability detection and interpretation capacity is not sufficient to explain exploitability effects that can propagte through the whole chain.
By Ljubica Grgic · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.