A security analyst discovers that an attacker has compromised a software vendor's update server and injected malicious code into a legitimate software update that customers downloaded. Which type of attack does this represent?

Question

Accepted Answer

B. Supply chain attack. A supply chain attack targets the less-secure components of the supply chain — such as a software vendor's update mechanism — to distribute malicious code to many victims who trust the vendor. Compromising a legitimate update server to inject malware into trusted updates is a classic supply chain attack vector.

A security analyst discovers that an attacker has compromised a software vendor's update server and injected malicious code into a legitimate software update that customers downloaded. Which type of attack does this represent?

Related Questions

Discussion