Supply-Chain Attacks
- SolarWinds / SUNBURST (2020): trojanized Orion updates pushed a backdoor to 18,000 organizations; attributed to a Russian state actor. The wake-up call for build-pipeline security.
- XZ Utils backdoor (CVE-2024-3094): a multi-year social-engineering operation planted a backdoor in a core Linux compression library, targeting OpenSSH via systemd. Caught by chance — a performance anomaly — days before wide distribution.
- Lesson: trust is transitive. Your dependencies' dependencies are your attack surface.
Key Takeaway
The XZ backdoor shows a determined adversary will invest years to become a trusted maintainer. Provenance matters.