The SolarWinds attack, which exploited weaknesses in a software update mechanism, highlights the critical need for organizations to have better visibility into their software dependencies and potential vulnerabilities associated with them. The Software Bill of Materials (SBOM) is paramount in ensuring software supply chain security. Under the Executive Order issued by President Biden, the adoption of the SBOM has become obligatory within the United States. The executive order mandates that an SBOM must be provided for all software purchased by federal agencies. In this paper, we present an in-depth and systematic investigation of the trust that can be put into the output of SBOMs. Our research reveals that the SBOM generation process across popular programming languages is susceptible to stealthy manipulation by malicious insiders, leading to significant supply chain insecurities. We then investigated the tools used to consume SBOMs, examining their capability to detect and handle manipulated or compromised SBOM data. To address these security issues, we analyze the use of public repositories for software libraries to validate the integrity of dependencies and demonstrate the feasibility of our proof-of-concept implementation. We further evaluate an alternative, decentralized approach based on blockchain.

翻译：SolarWinds攻击事件暴露了软件更新机制中的薄弱环节，凸显了组织对其软件依赖关系及相关潜在漏洞具备更佳可见性的迫切需求。软件物料清单（SBOM）对于保障软件供应链安全至关重要。根据拜登总统签署的行政命令，SBOM在美国境内的采用已成为强制性要求。该行政命令规定联邦机构采购的所有软件都必须提供SBOM。本文对SBOM输出结果的可信度进行了深入系统的研究。我们的研究表明，跨流行编程语言的SBOM生成过程易受恶意内部人员的隐蔽操控，从而导致严重的供应链安全隐患。随后我们调研了用于解析SBOM的工具，检验其检测和处理被篡改或已遭破坏的SBOM数据的能力。针对这些安全问题，我们分析了利用软件库公共存储库验证依赖项完整性的方法，并通过概念验证实现论证了其可行性。我们进一步评估了一种基于区块链的去中心化替代方案。