Supply Chain Attacks — Hacking Through Software Updates

Supply Chain Attacks — Trust No Software

Instead of attacking you directly, attackers compromise software you already trust and update automatically.

How Supply Chain Attacks Work

1. Attacker compromises a trusted software vendor
2. Malicious code is inserted into a legitimate update
3. The update is signed with the vendor's real certificate
4. Users automatically install the malicious update
5. Attacker gains access to ALL customers of that vendor

Major Supply Chain Attacks

SolarWinds (2020)

Russian hackers compromised SolarWinds' build system. Malicious update distributed to 18,000 organizations including US Treasury, DoD, and Fortune 500 companies.

Codecov (2021)

CI/CD tool compromised → attackers harvested environment variables and secrets from thousands of repositories.

npm/PyPI Package Poisoning

# Dependency Confusion Attack:
# Company uses internal package "company-utils"
# Attacker publishes "company-utils" on npm with higher version
# Build system downloads attacker's version instead!

# Typosquatting:
# Real: requests
# Fake: reqeusts, request, python-requests

3CX Desktop App (2023)

VoIP app used by 600,000+ companies → compromised build → malware distributed to all users.

Protection

• 🔒 Pin dependency versions in lock files
• 🔒 Use private registries for internal packages
• 🔒 Verify checksums of downloaded software
• 🔒 Monitor for unexpected network connections
• 🔒 Use SBOM (Software Bill of Materials)

🔥 Learn software security at Code Hacker →