PATCH//NOTES Open the interactive version
← All lessons
Threats · Intermediate · 4 min

Supply chain attacks

Why break in when you can ship inside a trusted update?

What it is

A supply chain attack compromises something many organisations trust (a software vendor, an update server, an open-source package or a managed service provider) so the attacker reaches all of their customers at once. Malicious npm and PyPI packages, typosquatted library names and hijacked maintainer accounts are now constant.

Real case · 2024

XZ Utils backdoor

Over two years, an attacker built trust as a helpful maintainer of a compression library used by Linux, then slipped in a backdoor targeting SSH. A Microsoft engineer spotted it because SSH logins were half a second slower than usual.

Source: Wikipedia: XZ Utils backdoor

How defenders stop it

  • Pin and verify dependencies; review what new packages do
  • Generate SBOMs so you can answer 'are we affected?' fast
  • Limit what build systems and vendors can access
  • Check signatures and provenance (frameworks like SLSA)

Try it yourself

Read the SLSA supply-chain framework

Check yourself

1. What made the XZ Utils attack so dangerous?

  1. It used a zero-click iPhone bug
  2. A trusted maintainer inserted the backdoor
  3. It spread through email
  4. It only affected Windows
Show answer

A trusted maintainer inserted the backdoor. Trust was the attack vector. Code review and reproducible builds are key defences.

2. Why do attackers target software vendors and open-source packages?

  1. It's legal
  2. One compromise reaches every organisation that trusts them
  3. They never use passwords
  4. They're easier to find on the internet
Show answer

One compromise reaches every organisation that trusts them. Compromising something many organisations trust lets an attacker reach all of its customers at once.

3. What is typosquatting in package registries?

  1. Encrypting a package
  2. Typing commands too quickly
  3. Misspelling a CVE ID
  4. Publishing a malicious package named like a popular one
Show answer

Publishing a malicious package named like a popular one. Attackers publish packages with names one typo away from popular libraries, hoping a developer installs theirs by mistake.

Answer them in the app to earn XP.

Next: Data breaches →