Lesson 3.75: Supply-chain attacks: when trusted software turns
Every company runs software written by others: operating systems, libraries, vendor tools and the updates for all of them. A supply-chain attack compromises one of those suppliers so that the victims install the attack themselves, through a normal update. Real examples include the SolarWinds Orion updates in 2020 and the backdoor found in the xz compression library in March 2024 (CVE-2024-3094). In the lab you use a software inventory to find out quickly whether Northwind is affected by two supply-chain notices, and write the actions.
16 min
You will learn to
- Explain what a supply-chain attack is
- Name real examples (SolarWinds 2020, xz utils 2024)
- Use a software inventory (SBOM) to check exposure
- Match affected versions precisely
- Decide actions: update, rebuild, rotate secrets
Key terms
- Supply-chain attack
- Compromising a supplier (software, update, service) to reach its customers.
- SBOM
- Software bill of materials: a list of the components and versions in your software and systems.
- Dependency
- A library or package your software needs and installs from someone else.
- Package registry
- A public store of packages, such as npm or PyPI.
- Secret rotation
- Replacing passwords, keys and tokens that may have been exposed.
← Cryptographic mistakes in code · All lessons · Running phishing simulations ethically →