# Software Supply Chain Security

# About

Software supply chain attacks are not a new attack vector - but one that we've seen increasing use of as many prominent organizations have created sophisticated security practices internally. When this happens, attackers look for other weaknesses - and more often than not, those weak points are often in the supply chains those organizations use.

On this page, I want to collect articles and details about recent and novel supply chain style attacks, all of which help inform a talk on supply chain security that I'm constantly revising.

# On this page

# What is a Software Supply Chain?

The supply chain is much broader than many give it credit for. When I say "software supply chain," what's the first thing that comes to mind? Often that would the direct dependencies of the code itself - open source dependencies brought into the code. And while open-source dependencies are an essential part of the software supply chain, they are far from the only point to consider when thinking about supply chain security.

Other parts of your supply chain include the code you write, any 3rd party libraries you're using (not just the open sources ones), the dependencies you inherit by proxy (the dependencies of your dependencies), your DevOps tools and processers. Any tools and plugins those tools use, any vendor code, and any dependencies that those vendors have.

# Futher Reading

# Me

# Other People

# Software Bill of Materials (SBOM)

# Supply Chain Attacks

Below are some supply chain attacks I've done some amount of research on in the past. You can also find a complete open list of supply chain attacks and breaches on the CNCF TAG Security repo.

# Solarwinds/Sunburst

Attacking the DevOps environment - in this case the CI/CD systems which are very poorly secured - allows attackers to inject and sign malicious software.

# Birsan Dependency Bug Bounties

Hacking Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber with open source dependancy man-in-the-middle style attacks.

# PHP source code attack

Inserting backdoors into 78% of the internet by attacking the source code management system.

# Network-devices as a vector to homes & businesses

# Unintentional supply chain disruptions

# Undiscovered open source vulnerabilities

# Comments