Supply chain attacks in 2021

I'll try to keep this list updated for all supply chain attacks in 2021. Send input to blog@[this domain] if I missed something.

In a supply chain attack, attackers gain access to their target not by attacking the target directly, but by attacking one of its suppliers. This type of attack is getting more common.

Modern software development is dependent on large numbers of third-party dependencies. From a security standpoint, this has advantages and disadvantages. For critical functionality like password managers or crypto implementations, this ensures that developers have access to high-quality security libraries and tools, instead of each developer having to create custom implementations with bugs and weaknesses.

However, these dependencies are a very attractive way to hack into downstream users. Getting malicious code into any single dependency may be very hard, but when projects may have thousands of dependencies (common in modern npm based web applications), the statistics favour the attacker as they only need to target the dependency with the weakest defense measures.

Updates are in a similar situation. Updates can and do patch security issues and bugs. However, for most developers it is unfeasable to thoroughly check the integrity of every update which is applied, as that would require reading and understanding the entire diff between the old and new versions. The vast number of dependencies typically used, and the requirement to also look for extremely subtle bugs/backdoors (like goto fail;, or tactics from the Underhanded C Contest make it practically impossible to vet every single update. This makes updates another attractive vector for attacking downstream users.

I wish I had a permanent solution for this current weakness to supply-chain attacks. But some basic prudency can go a long way. Keep the number of used dependencies to a minimum. There's no need to add left-pad as a dependency. Before introducing a new dependency, check if the publisher uses two-factor-authentication, if possible. Don't use NPM.