Analysing a real supply chain attack

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. In a supply chain attack case study, which company do attackers breach FIRST?

A The trusted supplier whose software many customers use

B Every customer one by one

2. How did the malicious code spread in the SolarWinds attack of 2020?

A Hidden inside a normal-looking software update

B Through a fake email sent to every customer

3. Why did customers install the malicious update without suspicion?

A It came from a supplier they already trusted

B They were forced to by the attackers

4. Which is a better description of who was affected in a supply chain attack?

A Only the supplier that was breached

B Many organisations that used the supplier's software

5. When analysing a case study, which question traces how the update spread?

A What colour was the supplier's logo?

B How did the infected update reach customers?

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1supplier = "SolarWinds Orion"		Aif update.signed: install(update)
2update.install() -> backdoor		BThis trusts an update only because it comes from a known supplier. That blind trust is the weakness a supply chain attack exploits.
3Working out who was affected: every customer of the supplier who installed the bad update.		CCustomers installed a real-looking update that secretly carried hidden malicious code.
4The update spread because customers trusted the supplier and installed it without suspicion.		DThis shows attackers targeting each victim separately. A supply chain attack breaches one supplier and reaches many victims through it.
5attack = hit(each_customer)		Evictims = supplier.customers
6if from_supplier: skip_checks()		FThe trusted supplier that was breached. Its software was the single entry point for the whole attack.

Definitions

supply chain attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

supplier = "SoftCo" breached = ____ print(supplier, breached)

customers = ["A", "B", "C"] ___ c in customers: print("update sent to", c)

victims = ["School", "Bank", "Council"] total = ___(victims) print(total)

suppliers = 1 victims = 18000 ratio = victims _ suppliers

def reach(customers): ______ len(customers) print(reach(["A", "B"]))

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A supplier == 'BuildCo'

B update = 'v2.1 (infected)'

C victims = []

D victims.append('School A')

Question 2

A supplier_breached = True

B update_signed = True

C if supplier_breached

D print('Do not trust update')

Question 3

A customers = ['A', 'B', 'C']

B for c in customers:

C prnt(c, 'got update')

Question 4

A def spread(update victims):

B for v in victims:

C v.install(update)

D return len(victims)

Question 5

A downloaded = 1000

B targeted = 10

C share = targeted / downloaded

D print(share / 100, '%')

Answer Key

Analysing a real supply chain attack

Section A: Quick Questions

A — The trusted supplier whose software many customers use

A — Hidden inside a normal-looking software update

A — It came from a supplier they already trusted

B — Many organisations that used the supplier's software

B — How did the infected update reach customers?

Section B: Match the Pairs

supplier = "SolarWinds Orion" → The trusted supplier that was breached. Its software was the single entry point for the whole attack.

update.install() -> backdoor → Customers installed a real-looking update that secretly carried hidden malicious code.

Working out who was affected: every customer of the supplier who installed the bad update. → victims = supplier.customers

The update spread because customers trusted the supplier and installed it without suspicion. → if update.signed: install(update)

attack = hit(each_customer) → This shows attackers targeting each victim separately. A supply chain attack breaches one supplier and reaches many victims through it.

if from_supplier: skip_checks() → This trusts an update only because it comes from a known supplier. That blind trust is the weakness a supply chain attack exploits.

Section C: Definitions

supply chain attack — An attack where hackers breach one trusted supplier and use its software update to reach many victims. A case study traces the supplier, how the update spread and who was hit.

Section D: Fill in the Blanks

supplier = "SoftCo"
breached = True
print(supplier, breached)

customers = ["A", "B", "C"]
for c in customers:
    print("update sent to", c)

victims = ["School", "Bank", "Council"]
total = len(victims)
print(total)

suppliers = 1
victims = 18000
ratio = victims / suppliers

def reach(customers):
    return len(customers)
print(reach(["A", "B"]))

Section E: Spot the Error

A — A single = stores the supplier name in a variable. == compares values, so supplier would never be created. It should be supplier = 'BuildCo'.

C — An if statement must end with a colon. Without it Python gives a syntax error. It should be if supplier_breached:.

C — The function name is misspelled, so Python cannot find prnt(). The loop should show each customer who received the update with print(c, 'got update').

A — Parameters in a function definition must be separated by a comma. It should be def spread(update, victims):.

D — To turn a fraction into a percentage you multiply by 100, not divide. It should be print(share * 100, '%'), which shows the share of victims who were targeted.