3 ms·
Like some other commenters, I too initially balked at the apparent misuse of "supply chain attack" but the linked paper provides a good definition, A software
by tantalor 6y ago
Like some other commenters, I too initially balked at the apparent misuse of "supply chain attack" but the linked paper provides a good definition,
A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain.
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
https://link.springer.com/chapter/10.1007%2F978-3-030-52683-2_2 https://link.springer.com/chapter/10.1007%2F978-3-030-52683-...
To be clear, just calling this a "supply chain attack" and omitting "software" is going to cause confusion with traditional supply chains.
The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor.
- Terretta 6y ago> The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor. Not necessarily — plenty software still ships with the third party supply chain bits incorporated as binaries, including commercial software. User is relying on security of one or more in a chain of upstream vendors. See Cyberpunk 2077 DLLs for instance. https://twitter.com/CDPRED_Support/status/1356604047671898112?s=20 https://twitter.com/CDPRED_Support/status/135660404767189811... Cyberpunk “builds” their game with a software build system, but not all of it is them building it.
- tantalor 6y agoYes, good point of course. Although I would be very suspicious of binary deps served through npm.