Skip to content

Chapter 24 Quiz: Supply Chain Attacks

Test your knowledge of software supply chain attack vectors, detection methods, SBOM, and frameworks for supply chain security.

Questions

1. The SolarWinds SUNBURST attack (2020) is the defining case study for build pipeline compromise. What specific stage of the software supply chain did the attackers compromise, and what made detection so difficult?

  • A) The attackers compromised SolarWinds customer networks via phishing and installed SUNBURST laterally
  • B) The attackers injected malicious code into SolarWinds' build environment, causing the SUNBURST backdoor to be compiled into legitimate, digitally signed Orion software updates pushed to 18,000+ customers
  • C) The attackers exploited a zero-day in the Orion software's update mechanism to inject code during installation
  • D) The attackers compromised SolarWinds' CDN to serve modified installer files
Answer

B — The attackers injected malicious code into SolarWinds' build environment, causing the SUNBURST backdoor to be compiled into legitimate, digitally signed Orion software updates pushed to 18,000+ customers

SUNBURST was injected into the SolarWinds Orion build pipeline itself, meaning the resulting DLL was compiled and then digitally signed by SolarWinds with their legitimate code-signing certificate. Customers receiving the update had no way to distinguish it from a genuine release — the signature was valid, the update came from official SolarWinds infrastructure, and the backdoor remained dormant for 12-14 days after installation to evade sandbox analysis.

2. A developer publishes an internal package company-utils to their private registry. An attacker registers company-utils on the public PyPI repository with a higher version number. What attack does this describe and what makes it effective?

  • A) Typosquatting — exploiting developer typos when installing packages
  • B) Dependency confusion — exploiting package managers that prefer public registry packages over private ones when the same package name exists in both, or that fetch from public registries if the private package is unavailable
  • C) Build pipeline injection — compromising the CI/CD server
  • D) Credential stuffing against the private registry
Answer

B — Dependency confusion — exploiting package managers that prefer public registry packages over private ones when the same package name exists in both, or that fetch from public registries if the private package is unavailable

Dependency confusion (discovered/demonstrated by Alex Birsan in 2021) exploits how package managers (pip, npm, gem) resolve package names when both public and private registries are configured. By uploading a package with the same name as a private internal package but a higher version number to the public registry, the package manager may download the attacker's public version instead of the legitimate private one.

3. The XZ Utils backdoor (CVE-2024-3094) is notable for demonstrating a sophisticated supply chain attack vector not involving direct build system compromise. What attack method was used?

  • A) A zero-day vulnerability in XZ Utils' compression algorithm
  • B) A long-term social engineering campaign where an attacker created a fake open-source identity over 2+ years, gained maintainer trust, and eventually contributed malicious code that was merged into official releases
  • C) Dependency confusion via the XZ package name on npm
  • D) A compromised code-signing certificate for the XZ project
Answer

B — A long-term social engineering campaign where an attacker created a fake open-source identity over 2+ years, gained maintainer trust, and eventually contributed malicious code that was merged into official releases

The XZ Utils backdoor (discovered by Andres Freund in March 2024) involved an actor using the identity "Jia Tan" who spent over two years contributing legitimate improvements to XZ Utils, building trust with the maintainer, taking over maintenance responsibilities, and then introducing a highly obfuscated backdoor targeting systemd-linked sshd. This represents the most sophisticated known open-source supply chain attack.

4. A SBOM (Software Bill of Materials) is increasingly required by government procurement regulations (including US Executive Order 14028). What specific security use case does a SBOM enable that is otherwise impractical?

  • A) Encrypting all software components with unique keys
  • B) Rapid identification of all software in an organization's inventory affected by a newly disclosed vulnerability in a specific third-party library (e.g., Log4Shell) — enabling targeted remediation without manually auditing every application
  • C) Automatic patching of vulnerable dependencies without human review
  • D) Blocking all software from vendors without published SBOMs at the network firewall
Answer

B — Rapid identification of all software in an organization's inventory affected by a newly disclosed vulnerability in a specific third-party library (e.g., Log4Shell) — enabling targeted remediation without manually auditing every application

Without SBOMs, organizations had no systematic way to answer "which of our applications use Log4j?" during the Log4Shell crisis. A machine-readable SBOM for every application allows security teams to query: "show all applications containing log4j-core versions < 2.17.1" and get an answer in seconds. This transforms a multi-week manual audit into an automated query.

5. The SLSA (Supply-chain Levels for Software Artifacts) framework defines build integrity levels 1 through 4. What does achieving SLSA Level 3 specifically require that Level 2 does not?

  • A) Publishing a machine-readable SBOM alongside every release
  • B) The build platform itself must be hardened and auditable — builds must occur in an isolated, ephemeral environment with cryptographic attestation that the build steps cannot be tampered with by the developer submitting the code
  • C) All dependencies must themselves be SLSA Level 3 compliant
  • D) Code signing with an EV (Extended Validation) certificate
Answer

B — The build platform itself must be hardened and auditable — builds must occur in an isolated, ephemeral environment with cryptographic attestation that the build steps cannot be tampered with by the developer submitting the code

SLSA Level 2 requires a hosted build service that generates signed provenance. SLSA Level 3 strengthens the build platform guarantee: the build service must be hardened against tampering by the developer who submitted the build, use ephemeral isolated environments for each build, and provide cryptographic attestation of the complete build process. This addresses the SolarWinds scenario where a developer (or attacker with developer access) modified the build.

6. An analyst investigates a suspected supply chain compromise and finds that a third-party vendor's software update introduced a new process that makes outbound HTTPS connections to cdn-update[.]net — a domain registered 3 weeks ago. Which log source most directly evidences this as a potential supply chain IOC?

  • A) Windows Defender AV quarantine logs
  • B) DNS query logs and/or EDR process-network telemetry showing the new process (spawned by the vendor's software) making connections to domains not present in the vendor's historical network baseline
  • C) Active Directory authentication logs for the vendor's service account
  • D) File integrity monitoring alerts on the vendor's installation directory
Answer

B — DNS query logs and/or EDR process-network telemetry showing the new process (spawned by the vendor's software) making connections to domains not present in the vendor's historical network baseline

Supply chain compromise introduced via a software update is most efficiently detected by network behavioral change: the vendor's software suddenly communicates with infrastructure it has never contacted before. A recently registered domain (weeks old) contacted by a process that was previously network-silent is a high-fidelity indicator. EDR telemetry linking the network connection to the specific process/parent enables immediate scoping.

7. Code signing certificates are a critical supply chain security control. What attack against code signing does the 3CX supply chain attack (2023) demonstrate?

  • A) Attackers forged a code signing certificate using a collision attack against SHA-1
  • B) Attackers compromised a system that had access to 3CX's legitimate code signing certificate/private key, using it to sign the backdoored installer — making the malicious update indistinguishable from legitimate signed 3CX software
  • C) Attackers bypassed certificate validation by targeting 3CX's update server
  • D) The 3CX attack used an unsigned payload that Windows Authenticode ignored
Answer

B — Attackers compromised a system that had access to 3CX's legitimate code signing certificate/private key, using it to sign the backdoored installer — making the malicious update indistinguishable from legitimate signed 3CX software

The 3CX attack (attributed to Lazarus Group/North Korea) involved compromising 3CX's build or signing infrastructure to obtain access to their code signing certificate. The resulting trojanized installer was legitimately signed by 3CX — causing security products to trust it. Notably, 3CX itself was compromised via a prior supply chain attack on Trading Technologies software, making it a "double supply chain" attack.

8. What is "typosquatting" in the context of package registries, and how does it differ from dependency confusion?

  • A) Typosquatting and dependency confusion are the same attack with different names
  • B) Typosquatting exploits developer typing mistakes by registering similarly spelled package names (e.g., requets instead of requests); dependency confusion exploits package resolution logic when the same name exists in both public and private registries
  • C) Typosquatting targets DNS resolution; dependency confusion targets HTTP traffic
  • D) Typosquatting requires compromising the legitimate package; dependency confusion does not
Answer

B — Typosquatting exploits developer typing mistakes by registering similarly spelled package names (e.g., requets instead of requests); dependency confusion exploits package resolution logic when the same name exists in both public and private registries

Both attacks target software supply chains via package registries, but the mechanism differs: typosquatting relies on human error (a developer misspells a package name in their requirements file), while dependency confusion relies on automated package manager behavior (the resolver incorrectly prefers a public package over a private one with the same name). Each requires different mitigations.

9. A third-party risk management program must evaluate vendor security before granting network access. Which assessment activity specifically addresses the risk of a vendor being used as a supply chain pivot point into the organization?

  • A) Reviewing the vendor's SOC 2 Type II report for the past year
  • B) Assessing the vendor's software development lifecycle (SDLC) security, including whether they practice code signing, dependency scanning, SBOM generation, and have a documented response plan for build system compromise
  • C) Verifying the vendor's network perimeter firewall rules
  • D) Confirming the vendor maintains cyber liability insurance
Answer

B — Assessing the vendor's software development lifecycle (SDLC) security, including whether they practice code signing, dependency scanning, SBOM generation, and have a documented response plan for build system compromise

SOC 2 reports cover operational controls but rarely address build pipeline security in depth. For supply chain risk specifically, the critical question is: "Could this vendor be used to deliver malicious code to us?" — which requires SDLC security assessment: how are their builds protected, signed, and tested? Do they have an SBOM? What is their incident response plan if their build system is compromised?

10. Following detection of a supply chain compromise via a vendor software update, what is the recommended containment sequence?

  • A) Immediately re-image all affected systems, then notify the vendor
  • B) Isolate affected systems from the network, preserve forensic evidence (memory, logs, process trees), identify the full scope of compromise, notify the vendor and relevant CERTs, then plan remediation based on scope findings
  • C) Block the vendor's update server at the firewall and continue normal operations
  • D) Run a full antivirus scan on all systems that received the update before taking any other action
Answer

B — Isolate affected systems from the network, preserve forensic evidence (memory, logs, process trees), identify the full scope of compromise, notify the vendor and relevant CERTs, then plan remediation based on scope findings

Supply chain compromises often have broad blast radius and require careful scoping before remediation. Immediate re-imaging destroys forensic evidence needed to understand what was accessed. The correct sequence prioritizes: stopping lateral movement (isolation), preserving evidence, scoping the compromise (which systems received the update, what did the malicious component do), coordinating with the vendor and regulators, then remediating in order of priority.

Scoring

Score Performance
9–10 Expert — Supply chain attack concepts and defenses fully internalized
7–8 Proficient — Ready to assess and defend against supply chain risks
5–6 Developing — Review Chapter 24 SBOM, SLSA, and attack case study sections
<5 Foundational — Re-read Chapter 24 before proceeding

Return to Chapter 24 | Next: Chapter 25