What is a supply chain attack?
A supply chain attack reaches its real target through something the target already trusts: a software vendor, an open-source library, a managed service provider, a hardware shipment or a cloud application. Instead of breaking through the victim's defenses, the attacker compromises a weaker or more central supplier and inherits the access the victim granted it. The malicious code arrives as a signed update, or the commands arrive over a vendor connection that is supposed to be there.
Two things make these attacks hard to stop. The access is legitimate, so it blends in. And one compromise can reach many victims at once, because a popular product or provider sits inside thousands of organizations.
Forms of supply chain attack
- Tampered software updates: in 2020, attackers inserted a backdoor into builds of SolarWinds Orion. The signed updates went out through the normal channel, and SolarWinds said up to about 18,000 customers installed them.
- Compromised open-source packages: in 2024 a backdoor planted by a long-trusted contributor was found in the xz Utils compression library (
CVE-2024-3094) before it reached most stable Linux releases. Typosquatted packages, such as the npm package crossenv in 2017, imitate popular names to steal developers' secrets. - Managed service providers: in July 2021 the REvil ransomware group exploited Kaseya's VSA remote management product and pushed ransomware through MSPs to many of their customers at once.
- Third-party vendor access: the 2013 Target breach began with network credentials stolen from the retailer's HVAC contractor.
- Hardware and logistics: devices intercepted in transit, firmware altered before delivery, or counterfeit components.
- SaaS providers: a breach at a hosted application exposes every customer's data together.
Why code signing alone doesn't stop it
A code signature proves who published a file and that it hasn't changed since it was signed. It does not prove the code is safe. In the SolarWinds case the backdoor was added during the vendor's own build process, so the malicious updates carried a valid SolarWinds signature. Signature and hash checks still matter, because they stop tampering after release, such as a modified installer on a download mirror, but they can't catch a compromise inside the supplier.
Controls against supply chain attacks
- Vendor due diligence: assess a supplier's security before buying, and put requirements such as breach notification in the contract.
- Least privilege for vendors: scope MSP and contractor accounts tightly, require MFA, monitor and record vendor sessions, and be able to cut the connection quickly.
- Software bill of materials (SBOM): know which components and versions each product contains, so you can tell within hours whether a newly disclosed library flaw affects you.
- Dependency hygiene: pin versions, use trusted or private package registries, scan dependencies and check package names carefully.
- Integrity checks: verify code signatures and published hashes on downloads and updates.
- Trusted hardware sources: buy through authorized channels, inspect devices on receipt and verify firmware.
- Detection: watch trusted software and vendor tools for behavior outside their normal pattern, such as an update agent opening new outbound connections.
Supply chain attack vs. similar attacks
A watering hole attack compromises a website the victims visit; a supply chain attack compromises a product, update or service they buy, install or connect to. A contractor vector on its own centers on a person with a badge or account inside your organization, while an attack that comes through the contractor firm's own systems or tools is supply chain. And a malicious update the vendor never intended differs from an ordinary vulnerability in that vendor's software, which is a flaw to patch.
Supply chain attack on the CompTIA Security+ exam
SY0-801 objective 2.3 lists supply chain vectors: third-party providers, managed service providers, logistics providers and software-as-a-service providers. Scenario wording that points here includes a breach that arrived through a vendor's remote access, malware delivered in a legitimate signed update, an attack spreading from a provider's management tool to many customers, hardware compromised before delivery, or customer data exposed through a hosted application. The best answers are least-privilege, monitored and verified vendor access, vendor due diligence, an SBOM and integrity checks on what you install. Watering hole and contractor are the usual distractors. Supply chain attacks also appear in A+ Core 2 (220-1202) objective 2.5.