Tech, ExplainedNetworking, infrastructure and security
Concept

Supply chain attack

The breach that arrives through a supplier.

HOW IT WORKSAn attacker breaksinto a supplier thatis easier to reachIt adds its owncode to an update,or steals thesupplier's loginEach customer acceptsthe update or thelogin, because ittrusts the supplierThe attacker reachesmany customers at onceCustomers limit,record and check whateach supplier can doOne break-in at a trusted supplier can reach every customer at once, so trust in suppliers must bechecked and limited.HOW IT WORKSAn attackerbreaks into asupplier thatis easierto reachIt adds itsown code toan update, orsteals thesupplier'sloginEach customeraccepts theupdate orthe login,becauseit truststhe supplierThe attackerreaches manycustomersat onceCustomerslimit, recordand checkwhat eachsuppliercan doOne break-in at a trusted supplier can reach every customer at once, so trust in suppliers must bechecked and limited.HOW IT WORKSAn attacker breaks into a supplier thatis easier to reach↓It adds its own code to an update, orsteals the supplier's login↓Each customer accepts the update or thelogin, because it trusts the supplier↓The attacker reachesmany customers at once↓Customers limit, record and check whateach supplier can doOne break-in at a trusted supplier can reach everycustomer at once, so trust in suppliers must be checkedand limited.
An attacker breaks into a supplier, plants code in its update or steals its login, and reaches every customer that trusts that update or login.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

A supply chain attack is a break-in that reaches a company through one of its suppliers, instead of attacking the company directly. The supplier might be a software maker whose updates the company installs, an open-source library inside its code, or a contractor that logs in to its systems. The attacker breaks into the supplier, which is often easier to reach, and uses the trust the company already gives that supplier.

Here is how it works in general. The attacker first breaks into the supplier. Then it does one of two things. It may add its own code to the supplier's next software update. The update is signed by the supplier, so every customer's systems accept it as genuine. Or it may steal the login that the supplier uses to reach its customers, such as an IT support firm's remote-access account. Either way, one break-in can reach hundreds of customers at once. The customers usually have no reason to suspect anything, because the update or the login is one they expect.

Companies defend against this in three ways. Third-party risk management assesses each supplier before and during the contract, through questionnaires and through scans of the supplier from the outside. A software bill of materials lists every library inside a product, so a company can see quickly whether it is affected. And vendor privileged access management gives each supplier a narrow, recorded login, in line with least privilege. Indian regulators such as the RBI and SEBI also expect banks and brokers to check the security of their key suppliers.

Take, for example, a network-monitoring tool used by thousands of companies. Attackers who reach its maker's build system can add a hidden back door to a routine update, and every customer that installs the update installs the back door too.

Consider a hospital whose computers are maintained by an outside IT firm. If the firm's remote-access password is stolen, the attacker logs in to the hospital as that firm.

Say an online shop's checkout page loads a small script from a chat-widget provider. If attackers change that script on the provider's server, it can copy every card number typed on the shop's page.

How is a supply chain attack different from a flaw in an open-source dependency? A flaw such as Log4j was a mistake in a library, which attackers then found and used. In a supply chain attack, the attacker deliberately plants the harm in something the supplier ships or uses. Both arrive through code or access that the company did not build itself.

Appears in

Networking, infrastructure and security
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.