Attackers infiltrate a trusted vendor or software provider to distribute malicious updates or gain indirect access to many customers.
Why It Matters
- Single breach can cascade across industries.
- Abuses trust in update mechanisms and third-party code.
- Hard for end-users to detect or block.
Real-World Example
The SolarWinds Orion compromise (2020) impacted government and enterprise networks globally.
How to Reduce Risk
- Vendor risk assessments and contractual security requirements.
- Adopt SBOM, code signing verification, and allowlisting.
- Segment critical systems and monitor for anomalous updates.
Ratings
- ⚠️ Risk: ⭐⭐⭐⭐⭐
- 🛠 Exploitation Uses: ⭐⭐⭐⭐
- 💻 Technical Difficulty: ⭐⭐⭐⭐⭐
