English
Menu

What is Supply chain attack?

An attack that, instead of attacking the target organization directly, attacks weak points in the flow of supplies the organization relies on (its supply chain), such as software, components or contractors, to get in indirectly. Examples include inserting malicious code into legitimate updates, hijacking open-source packages or publishing malicious packages with similar names, and intrusion via IT contractors. In the SolarWinds incident discovered in 2020, damage spread to many organizations through legitimate signed updates. In hardware, hardware Trojans added during manufacturing are also a threat of this kind.

Japanese name: サプライチェーン攻撃

Supply chain attack appears in 2 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Supply chain attack

A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?

  1. AKeep the version numbers of internal-only libraries small so that they are easy to tell apart from packages in the public repository
  2. BPut internal-only packages in a namespace managed by the organization, configure that namespace to be fetched only from the internal repository, and pin versions and hash values with a lock file
  3. CPackages in public repositories are reviewed and trustworthy, so there is no need to configure which repository to fetch from
Show answer and explanation

Answer: B. Put internal-only packages in a namespace managed by the organization, configure that namespace to be fetched only from the internal repository, and pin versions and hash values with a lock file

Dependency confusion is a kind of software supply chain attack. Some package managers consult several repositories and, depending on their settings, choose the higher version number when the same name exists, and attackers abuse this to get a malicious package with the same name as an internal one pulled in. The countermeasure is to use a namespace (scope) managed by the organization for internal packages, tie that namespace only to the internal repository and state explicitly which repository each package is fetched from. In addition, pinning the versions and hash values of dependencies with a lock file prevents them from being silently replaced by something else. Registering the organization's namespace in the public repository first also helps prevent impersonation.

In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?

  1. AUpdates with a valid code signature never contain malicious code, so it is enough for users to check the signature
  2. BUpdates are dangerous, so software should never be updated at all, including security fixes
  3. CA code signature shows only who signed and whether the code was altered after signing, so developers must protect the build environment and users must also monitor the behavior of trusted software
Show answer and explanation

Answer: C. A code signature shows only who signed and whether the code was altered after signing, so developers must protect the build environment and users must also monitor the behavior of trusted software

Code signing confirms who signed and that the contents were not changed after signing; it cannot recognize malicious code mixed in before signing. In the SolarWinds incident, a prime example of a software supply chain attack, malicious code was added during the build, so it reached many organizations as legitimate signed updates. In the xz-utils backdoor discovered in March 2024 as well, a person who had spent a long time gaining trust as a developer slipped malicious code into the distributed files. It is important that developers isolate and protect the build environment and record and verify provenance from source to build, and that users monitor even trusted software for suspicious traffic and behavior with EDR and similar tools.

Supply chain attack in the explanations

Questions that mention Supply chain attack (2)

  1. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?
  2. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

EDR (endpoint detection and response) Cyber Kill Chain Digital forensics Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) Lateral movement MITRE ATT&CK Penetration testing SBOM (software bill of materials)

Back to the glossary