The SolarWinds hack compromised 18,000 organizations by hiding malware in a software update. Supply chain attacks are among the most dangerous threats in cybersecurity — here's why.
In December 2020, cybersecurity firm FireEye discovered that its own security tools had been compromised — and that the compromise had come through a software update from SolarWinds, a widely-used IT management platform. The attackers, later attributed to Russian intelligence, had inserted malicious code into SolarWinds' Orion software update process. When 18,000 organizations — including the U.S. Treasury, State Department, Pentagon, and hundreds of Fortune 500 companies — installed the routine update, they installed the malware along with it. The SolarWinds attack is the defining example of a supply chain attack: compromising a trusted supplier to reach the supplier's customers.
Why supply chain attacks are so dangerous: traditional security focuses on defending your own perimeter — your network, your devices, your software. Supply chain attacks bypass this entirely by compromising something you've already decided to trust. When you install a software update from a vendor you've used for years, you're not running a security scan — you're trusting the vendor's security. Supply chain attackers exploit this trust relationship. The attack surface is enormous: every piece of software you use, every library those programs depend on, every service those libraries call. Modern software is built on thousands of dependencies, any one of which could be compromised.
The XZ Utils backdoor (2024): a near-miss that revealed the scale of the risk. In early 2024, a Microsoft engineer discovered that XZ Utils — a compression library present in virtually every Linux distribution — had been backdoored by a sophisticated attacker who had spent two years building trust in the open-source project under a false identity before inserting malicious code. The backdoor would have given the attacker remote access to any Linux system running the affected version. It was caught by accident, days before it would have been included in major Linux distributions. The incident revealed how vulnerable the open-source software supply chain is to patient, sophisticated attackers.
npm and PyPI attacks: the package ecosystem problem. The JavaScript (npm) and Python (PyPI) package ecosystems contain millions of open-source packages that developers install as dependencies. Attackers have repeatedly exploited this ecosystem through typosquatting (publishing malicious packages with names similar to popular legitimate packages — 'lodahs' instead of 'lodash'), dependency confusion (publishing packages with the same name as internal company packages to intercept installations), and account takeover (compromising the accounts of popular package maintainers to push malicious updates). These attacks target developers, but the malicious code ultimately reaches end users through the applications developers build.
What consumers can do: the honest answer is that supply chain attacks are largely outside individual consumers' control. You cannot audit the software supply chain of every application you use. What you can do: keep software updated (while updates can be a vector for supply chain attacks, the risk of running unpatched software is far higher than the risk of a supply chain attack in any given update). Use software from reputable vendors with strong security practices. Be cautious about installing obscure browser extensions, which have been a common supply chain attack vector. Enable automatic updates for your operating system and major applications. Use a security product with behavioral detection that can catch malicious behavior even from trusted software.
The systemic response: supply chain security has become a major focus of both the security industry and government policy. The Biden administration's 2021 Executive Order on Improving the Nation's Cybersecurity required software vendors selling to the federal government to provide a Software Bill of Materials (SBOM) — a list of all components in their software, similar to an ingredient list. Code signing (cryptographic verification that software comes from who it claims to come from and hasn't been modified) is increasingly required. And the security community has developed frameworks like SLSA (Supply-chain Levels for Software Artifacts) to help organizations assess and improve their supply chain security posture. These are systemic improvements that benefit all users, even if individual consumers can't directly implement them.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.