The Rise of Malware Within the Software Supply Chain
summary
Malicious injections into open source and third‑party components are increasing: an ESA study finds 66% of supply‑chain attacks start with supplier software, SolarWinds compromises ~30,000 downstream customers using four crafted strains—SunSpot SunBurst TearDrop RainDrop—and a CodeCov breach abuses exposed Docker credentials; ReversingLabs uses static binary analysis, SBOMs, SLSA, VEX and YARA/file‑reputation hunting to flag unexpected behaviors. Over 100 typo‑squatted packages hit >17,000 downloads, so harden builds, verify origins, monitor behavioral deltas, and proactively hunt malware.
AI-written summary · about
chapters (20)
- 0:00Introduction to talk
- 1:29Defining software publishers and consumers
- 3:34Supplier ecosystem and software risks
- 5:42Why software suppliers are targeted
- 7:30Characteristics of software supply chain attacks
- 11:02Threat landscape and attack techniques
- 12:29SLSA attack model overview
- 14:17SolarWinds attack deep dive
- 22:26CodeCov attack analysis
- 26:17Dependency confusion attacks
- 28:06Tooling shortcomings in malware detection
- 30:36Frequency of malware vs vulnerabilities
- 32:40Industry standards and gaps
- 34:26Actionable solutions for publishers
- 35:09Verifying software components
- 37:19Hardening build environments
- 38:24Identifying suspicious software behavior
- 38:46Proactively hunting for malware
- 39:09Key takeaways and recap
- 40:14Q&A session
related talks
41mHow to protect your software project from supply chain security threats
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
33mYour Silent Software Saboteur: Open Source Malware
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
37mSupply Chain Attacks and the Future of Software Delivery
58mAttacking through the Software Supply Chain
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target