Supply Chain Attack

A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.

Term

description · examples · notes

Description

In software that can be malicious code slipped into a legitimate update, a compromised open source package, an altered build process, or a stolen maintainer's account. With services, the attacker uses a supplier's access, an integration or an administrative channel. Either way, trust becomes the channel of attack.

That is what makes these attacks hard to defend against. Classic controls often trust a signed update, a known supplier, or a permitted connection. One compromised link can hit hundreds or thousands of organizations that were never the direct target.

Examples

A legitimate software update contains injected malicious code and reaches users through the regular update mechanism.
A compromised package in a public registry enters the CI/CD process and executes during the build.
A supplier with access to customer systems is compromised, and the attacker uses the existing channel of trust.

Notes

The supply chain is not only software. It takes in suppliers, integrations, tools, update servers, packages, firmware and the people who maintain them.
If something is automatically fetched, signed, installed or released into production, it is part of the chain of trust and needs control.

Mentioned in the news

Techniques

carried out with 5

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 10

How it is defended against. Select one to open its page.