GoSurf：识别Go语言中的软件供应链攻击向量
GoSurf: Identifying Software Supply Chain Attack Vectors in Go
AI总结：
本研究针对Go语言供应链安全风险，提出含12种攻击向量的专属分类体系，并开发静态分析工具GoSurf，经真实Go包验证，可为Go生态供应链安全审计提供支撑。
摘要：
在Go语言中，开源软件的广泛采用催生了繁荣的第三方依赖生态，这类依赖常被集成到关键系统中。然而，依赖复用带来了显著的供应链安全风险，单个被攻陷的包就可能产生级联影响。现有的供应链攻击分类体系忽略了可被攻击者利用来隐藏恶意代码的语言特有特性。本文提出了一套专为Go语言及其包生命周期定制的、包含12种不同攻击向量的全新分类体系。该分类体系识别了原本用于良性用途的Go语言特有特性被滥用、从而通过供应链隐秘传播恶意代码的模式。此外，我们推出了静态分析工具GoSurf，它可依据我们提出的分类体系分析Go包的攻击面。我们在一组广泛使用的真实世界Go包语料上对GoSurf进行了评估。本工作为保障Go生态系统内的开源软件供应链安全提供了初步见解，可帮助开发者和安全分析师优先安排代码审计工作并发现隐藏的恶意行为。
英文摘要：
In Go, the widespread adoption of open-source software has led to a flourishing ecosystem of third-party dependencies, which are often integrated into critical systems. However, the reuse of dependencies introduces significant supply chain security risks, as a single compromised package can have cascading impacts. Existing supply chain attack taxonomies overlook language-specific features that can be exploited by attackers to hide malicious code. In this paper, we propose a novel taxonomy of 12 distinct attack vectors tailored for the Go language and its package lifecycle. Our taxonomy identifies patterns in which language-specific Go features, intended for benign purposes, can be misused to propagate malicious code stealthily through supply chains. Additionally, we introduce GoSurf, a static analysis tool that analyzes the attack surface of Go packages according to our proposed taxonomy. We evaluate GoSurf on a corpus of widely used, real-world Go packages. Our work provides preliminary insights for securing the open-source software supply chain within the Go ecosystem, allowing developers and security analysts to prioritize code audit efforts and uncover hidden malicious behaviors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
