Hyperledger Global Forum 2021

A software supply chain attack happens when a malicious party modifies any part of a software development stack to compromise a target down the chain. Any user of the target can be breached using the modifications in order to attack the system directly or to deliver a malicious payload. The recently well-publicized Solar winds hack has brought this vulnerability into focus. A vulnerability that has gained in potency and reach due to widespread use of COTS and COSS software. This talk starts by covering the history of such attacks as well as the types and the lead actors in the attacks. Open source software is crucial in the software ecosystem. The openness of FOSS is leveraged by supply chain attackers. The talk is aimed at raising awareness of supply chain vulnerability in open source development. Some mitigation measures are discussed, including applicability to Hyperledger.