Secure Crowdsource-Based Open-Source Code Verification (SC)²V

Open-source software (OSS) libraries have become popular among developers due to their ability to reduce development time and costs. However, OSS can be exploited as a means of conducting OSS supply chain attacks where malicious code is injected into those libraries. Previous studies have proposed various methods for preventing and detecting such attacks, however most of them focused on untargeted attacks. In contrast, this paper focuses on targeted OSS supply chain attacks which are crafted towards a specific target (e.g., developer) and performed by skilled and persistent attackers with strong technical aptitude. Since these attacks do not appear in the general OSS repositories, they tend to go under the radar for a long period of time, allowing an attacker to gain access to sensitive data or systems. In this paper, we propose (SC)²V - a novel, distributed framework for secure crowdsource-based code verification of OSS libraries, which is integrated into the software production build phase. (SC)²V aims to prevent targeted supply chain attacks, involving users and verifiers in a collaborative effort. (SC)²V was evaluated on 900 OSS libraries in different attack scenarios where it took our framework an average of just 26 seconds to issue an alert for various threats.