3 citations · 6 across the 15 of their papers we have counts for
16 papers
Can SOLARBURST go silicon? A systematic analysis on software supply chain attacks for VLSI design flows
Fabiha Hashmat, Zeren Li, Santiago Torres-Arias
An attacker targeting the software supply chain (SWSC) of VLSI tools can fully subvert the VLSI design pipeline through purely software level compromises. However, cur- rent litera…
Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations
Abhishek Reddypalle, Dennis Roellke, Santiago Torres-Arias
Modern software supply chains have evolved into vast, heterogeneous networks where transparency - the granular understanding of all software components - is now a critical security…
Identity-Based Signing Shifts, Not Solves, Usability: Evidence from Five Identity-Based Signing Ecosystems
Kelechi G. Kalu, Hieu Tran, Santiago Torres-Arias +2
Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the burden of long-lived key management. These tools are becoming critical…
Trustworthy and Confidential SBOM Exchange
Eman Abu Ishgair, Chinenye Okafor, Marcela S. Melara +1
Software Bills of Materials (SBOMs) have become a regulatory requirement for improving software supply chain security and trust by means of transparency regarding components that m…
ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
Kelechi G. Kalu, Sofia Okorafor, Betül Durak +4
Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from…
Why Johnny Adopts Identity-Based Software Signing: A Usability Case Study of Sigstore
Kelechi G. Kalu, Sofia Okorafor, Tanmay Singla +3
Software signing is the most robust method for ensuring the integrity and authenticity of components in a software supply chain. Legacy key-managed signing tools (e.g., OpenPGP) bu…
A Study of Malware Prevention in Linux Distributions
Duc-Ly Vu, Trevor Dunlap, Karla Obermeier-Velazquez +4
Malicious attacks on open-source software packages are a growing concern. The discovery of the XZ Utils backdoor intensified these concerns because of the potential widespread impa…
Establishing Provenance Before Coding: Traditional and Next-Gen Software Signing
Taylor R. Schorlemmer, Ethan H. Burmane, Kelechi G. Kalu +2
Software engineers integrate third-party components into their applications. The resulting software supply chain is vulnerable. To reduce the attack surface, we can verify the orig…
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
Chinenye Okafor, Taylor R. Schorlemmer, Santiago Torres-Arias +1
This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties cr…
Context-Aware Trust Verification for Identity-Based Software Signing
Chinenye Okafor, James C. Davis, Santiago Torres-Arias
Modern software release infrastructure uses identity-based software signing to associate software artifacts with a known identity. For example, registries such as npm and Docker Hu…
An Industry Interview Study of Software Signing for Supply Chain Security
Kelechi G. Kalu, Tanya Singla, Chinenye Okafor +2
Many software products are composed of components integrated from other teams or external parties. Each additional link in a software product's supply chain increases the risk of t…
SoK: A Defense-Oriented Evaluation of Software Supply Chain Security
Eman Abu Ishgair, Marcela S. Melara, Santiago Torres-Arias
The software supply chain comprises a highly complex set of operations, processes, tools, institutions and human factors involved in creating a piece of software. A number of high-…
Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors
Taylor R Schorlemmer, Kelechi G Kalu, Luke Chigges +5
Many software applications incorporate open-source third-party packages distributed by public package registries. Guaranteeing authorship along this supply chain is a challenge. Pa…
Rust for Embedded Systems: Current State, Challenges and Open Problems (Extended Report)
Ayushi Sharma, Shashank Sharma, Santiago Torres-Arias +1
Embedded software is used in safety-critical systems such as medical devices and autonomous vehicles, where software defects, including security vulnerabilities, have severe conseq…
ZTD: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Paschal C. Amusuo, Kyle A. Robinson, Tanmay Singla +5
Third-party libraries like Log4j accelerate software application development but introduce substantial risk. Vulnerabilities in these libraries have led to Software Supply Chain (S…
Speranza: Usable, privacy-friendly software signing
Kelsey Merrill, Zachary Newman, Santiago Torres-Arias +1
Software repositories, used for wide-scale open software distribution, are a significant vector for security attacks. Software signing provides authenticity, mitigating many such a…