English
Menu

Cyber Attacks and Defense in Practice

In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?

  1. AUpdates with a valid code signature never contain malicious code, so it is enough for users to check the signature
  2. BUpdates are dangerous, so software should never be updated at all, including security fixes
  3. CA code signature shows only who signed and whether the code was altered after signing, so developers must protect the build environment and users must also monitor the behavior of trusted software
Show answer and explanation

Answer: C. A code signature shows only who signed and whether the code was altered after signing, so developers must protect the build environment and users must also monitor the behavior of trusted software

Code signing confirms who signed and that the contents were not changed after signing; it cannot recognize malicious code mixed in before signing. In the SolarWinds incident, a prime example of a software supply chain attack, malicious code was added during the build, so it reached many organizations as legitimate signed updates. In the xz-utils backdoor discovered in March 2024 as well, a person who had spent a long time gaining trust as a developer slipped malicious code into the distributed files. It is important that developers isolate and protect the build environment and record and verify provenance from source to build, and that users monitor even trusted software for suspicious traffic and behavior with EDR and similar tools.

  • A. A signature cannot recognize malicious code mixed in before signing. The updates in this incident also carried legitimate signatures.
  • B. Stopping updates leaves known vulnerabilities in place and actually increases the risk.
  • C. Correct. Understand the limits of what a signature confirms, and combine protection of the build environment with monitoring of behavior.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. It was found that files containing customer information in cloud object storage could be read by anyone on the internet. Which of the following is an appropriate combination of a typical cause of this kind of leak and a measure to prevent recurrence?
  2. An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?
  3. An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?
  4. Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?
  5. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?

Comparisons in this topic