When Your Vendor Becomes Your Vulnerability
The SolarWinds attack of 2020 changed the cybersecurity world's understanding of risk. By compromising the build pipeline of a single IT management software vendor, attackers gained access to the networks of 18,000 organizations worldwide — including US government agencies, Fortune 500 companies, and critical infrastructure providers. All of these victims did nothing wrong: they trusted a legitimate, widely-used product.
This is a supply chain attack: compromising a target by first compromising someone (or something) they trust.
What Is a Software Supply Chain?
Every application your organization uses is built on a chain of dependencies:
- Open-source libraries (npm packages, Python libraries, Maven artifacts)
- Third-party APIs and SDKs
- Software vendors delivering updates to your environment
- Managed service providers (MSPs) with remote access to your infrastructure
- CI/CD pipelines and build tools
Each link in this chain is a potential attack vector.
Types of Supply Chain Attacks
1. Compromised Build Pipeline (SolarWinds-style)
Attackers infiltrate a software vendor's development environment and inject malicious code into a legitimate software update. Customers install the update and become infected — trusting the vendor's signature.
2. Dependency Confusion / Typosquatting
Attackers publish malicious packages to public repositories (npm, PyPI) with names similar to — or identical to — legitimate private packages. When developers install them, malicious code executes in their development environment.
3. MSP Compromise
Managed service providers often hold administrative access to hundreds of client environments. Compromising an MSP's systems provides attackers with a master key to all of their clients.
4. Open-Source Malware (XZ Utils, 2024)
Attackers invest months or years contributing to legitimate open-source projects, building trust before inserting malicious code. The 2024 XZ Utils backdoor — which nearly compromised SSH authentication on millions of Linux servers — demonstrates the sophistication of this approach.
Defensive Strategies
For Software Consumers
- Software Composition Analysis (SCA): Tools like Snyk, Dependabot, and Black Duck continuously scan your dependencies for known vulnerabilities and malicious packages.
- Vendor risk management: Assess the security posture of your software vendors and MSPs. Do they have SOC 2 certification? Do they conduct their own security testing?
- Least-privilege access for vendors: MSPs and vendors should have the minimum access required — with just-in-time provisioning and comprehensive logging.
- Network segmentation: Limit what trusted third-party software can reach within your network.
- Integrity verification: Verify software checksums and signatures before deployment.
For Software Producers
- Implement a secure Software Development Lifecycle (SSDLC)
- Protect your build environment with MFA, privileged access controls, and SIEM monitoring
- Generate and publish a Software Bill of Materials (SBOM) for your products
- Conduct regular third-party penetration tests of your development infrastructure
Conclusion
Supply chain security requires extending your threat model beyond your own perimeter. The organizations best positioned to defend against supply chain attacks are those with strong vendor risk management programs, comprehensive software composition analysis, and 24/7 monitoring that can detect anomalous behavior even from trusted software.
Oberon provides vendor risk assessments and supply chain security reviews. Contact our team.