The Dangerous Numbers Behind Supply Chain Attacks

Joao Correia

October 23, 2023 - Technical Evangelist

Supply chain attacks have witnessed a staggering surge in recent years, morphing into a formidable threat in the cyber landscape. When businesses are increasingly reliant on third-party software and open-source components, supply chain attacks have emerged as a viable and insidious vector for adversaries to exploit vulnerabilities in widely-used software, affecting numerous organizations simultaneously.

A Soaring Threat: Growth and Implications

The surge in software supply chain attacks is not just hypothetical, but is supported by alarming statistics. Between 2019 and 2022, software supply chain attacks skyrocketed by an astounding 742%, and 2023 is poised to set a new record.

The reliance on third-party software and open-source components, while crucial for operational agility and reduced development times, introduces significant risks. Due to this dependency on external code, by multiple companies and on different applications, an attack on a base library can quickly escalate into thousands of vulnerable software stacks, as exemplified by the recent WebP vulnerability.

The Inherent Risk in Third-Party Software

The expansive use of third-party software opens a pandora’s box of risks and challenges. Notably, according to Gartner, 60% of organizations work with over 1,000 third parties, introducing numerous potential entry points for adversaries.

Instances like the breach at JP Morgan Chase, which exposed usernames and passwords for millions of accounts due to a vulnerability in a third-party vendor’s website, underscore the tangible risks and vast impacts of such attacks.

The Infamy of Log4j

The Log4j vulnerability, or Log4Shell, exemplifies how a single vulnerability in a widely-used open-source library can cascade into a global cybersecurity crisis. This vulnerability was not just present in the direct dependencies but also in around 17,000 Java packages hosted on the Maven Central repository, as a direct or transitive dependency. Despite extensive patching efforts, many instances remain unpatched, presenting an ongoing risk to organizations across the globe.

The Complexity of Dependency Networks

Dependencies in software supply chains introduce additional layers of complexity and risk. Transitive vulnerabilities inherited from these dependencies have reached unprecedented levels, affecting two-thirds of open-source libraries.

The Log4Shell incident highlighted the criticality of visibility and awareness about these intricate supply chains, as the lack of understanding regarding their origins and dependencies can severely hamper vulnerability response efforts.

The Escalation in Numbers and Techniques

According to a report from Sonatype, the number of documented supply chain attacks involving malicious third-party components burgeoned by 633% within a year, amounting to over 88,000 known instances. Attack techniques have diversified, with dependency confusion, typosquatting, brandjacking, malicious code injection, and even protestware introducing new challenges and considerations for cybersecurity professionals.

The Dependency Confusion Conundrum

Dependency confusion attacks have particularly gained traction since their disclosure in February 2021. This technique exploits package management clients’ behavior, tricking them into utilizing malicious packages with higher version numbers from public repositories instead of legitimate packages in internal repositories. This underscores the necessity for organizations to register names of their private packages in public repositories or employ distinct prefixes to mitigate such risks.

Fortifying Defenses Against Supply Chain Attacks

The identification and mitigation of vulnerabilities form the crux of a robust defense strategy against supply chain attacks. It is not realistic to expect every single dependency to be vetted every time there is an update, and every dependency on that one, transitively, down the chain.

There are not enough resources available to perform this task, continually, as would be required to ensure proper defense. And even then, just like we see applications continually delivering bug fixing patches, it would be easy to miss problems that could lead to security issues.

One alternative is to rely on trusted repositories for your dependencies that perform this check for you. Services like SecureChain for Java, from TuxCare, offer just that – a curated, updated and reliable dependency source for your Java libraries, reducing the risk of pulling buggy or compromised dependencies from public or untrusted sources.

The dangerous numbers behind supply chain attacks paint a sobering picture of the cyber threatscape. The diversification and sophistication in attack techniques mandate a paradigm shift from mere prevention to proactive detection and mitigation strategies. Organizations need to embrace a holistic, informed, and adaptive approach to navigate through this intricate web of vulnerabilities and dependencies, safeguarding their digital assets and operational integrity against the burgeoning wave of supply chain attacks.

Summary