{"id":20987,"date":"2022-12-05T14:06:49","date_gmt":"2022-12-05T14:06:49","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/05\/report-finds-software-supply-chain-attacks-show-no-sign-of-slowing-down\/"},"modified":"2022-12-05T14:06:49","modified_gmt":"2022-12-05T14:06:49","slug":"report-finds-software-supply-chain-attacks-show-no-sign-of-slowing-down","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/05\/report-finds-software-supply-chain-attacks-show-no-sign-of-slowing-down\/","title":{"rendered":"Report finds software supply chain attacks show no sign of slowing down"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

A new report from\u00a0Reversing Labs Inc.<\/a> has found that nearly two years after the SolarWinds Worldwide LLC hack<\/a>, software supply chain attacks have shown no sign of slowing down or abating.<\/p>\n

The report found that attacks that leverage malicious open-source modules have continued to multiply in the commercial sector. Enterprise has seen an exponential increase in supply chain attacks since 2020 and a slower but still steady rise in 2022.<\/p>\n

One particular favorite for hackers is the popular open-source repository Node Package Manager. Some\u00a07,000 malicious package uploads to npm were detected from January to October, a nearly 100-fold increase over the\u00a075 malicious packages discovered in 2020 and a 40% increase in malicious packages found in 2021.<\/p>\n

One such attack, detailed by Reversing Labs in August<\/a>, involved more than two dozen npm packages that contain obfuscated JavaScript. The packages were designed to steal data from individuals using applications or websites where the malicious packages had been deployed.<\/p>\n

The Python Package Index, known as PyPi, was also found to be being flooded with tainted open-source modules designed to mine cryptocurrency and plant malware, among other things. The attacks were consistent with what researchers observed in 2021 when attackers commonly used dependency confusion and typosquatting techniques.<\/p>\n

High-profile organizations, including\u00a0Samsung Electronics Co. Ltd.<\/a> and Toyota Motor Co.,<\/a> were embarrassed by secrets exposed through open-source repositories maintained internally or by third-party contractors.<\/p>\n

The report notes that the attacks have increased the focus on software supply chain security. Following the issuance of the Biden Administration\u2019s May 2021 Executive Order on Improving the Nation\u2019s Cybersecurity, the past year has seen new federal guidance for tightening supply chain security.<\/p>\n

Included in various executive orders and initiatives has been a practice guide for software suppliers to the federal government issued by the Enduring Security Framework Software Supply Chain Working Panel. Also issued in September was a memorandum from the Office of Management and Budget that requires software firms to attest to the security of software and services they license to Executive Branch agencies.<\/p>\n

Looking forward, the report finds that software publishers with federal contracts will need to clear higher bars for software security to meet the new guidelines. The higher bars include having to attest to the security of their code and, in some cases, produce software bills of materials that provide a roadmap for tracking down supply chain threats.<\/p>\n

\u201cGiven that the threat of supply chain attacks goes beyond publishers that sell to the federal government, all organizations that develop software will need to take similar steps to keep ahead of these threats,\u201d the report\u2019s authors concluded.<\/p>\n

Image: Needpix<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n