← Years 9–10 Digital Systems

Compromised software updates

An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 66, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 41

Understanding Compromised software updates in Years 9–10 Digital Systems

What it does: The SolarWinds Orion update carried a hidden backdoor. Customers installed it because it came from the real vendor. The benefit of patching known flaws outweighs the small risk of a poisoned update, as long as the update comes from a trusted source. The attacker uses the normal, trusted update channel. That is why users and their devices let it through. Staying updated protects against known vulnerabilities. Good practice also includes official sources and monitoring for unusual behaviour after an update. This term names the core idea: the attacker targets the supplier instead of each user, and the poisoned update spreads the harm.

Common mistakes: In a supply chain attack the malicious code travels through the vendor's official update channel, not a phishing email. Line 1 should be channel = "official_update". This would install the update only when it is NOT signed, which skips an important safety check. Line 2 should be if update.signed == True: so only signed updates are installed.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Compromised software updates to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A supply chain attack hides malicious code in a trusted supplier's software update. Which statement describes it best?
Attackers send users a fake update link from a made-up companyAttackers slip bad code into a genuine update, so users install it thinking it is safe
Matches
if file_from_vendor: assume_safe = True
↓
Assuming an update is safe just because it comes from a trusted vendor. A supply chain attack hides malicious code inside a genuine update.
Applying
Meanings
Term
Supply chain attack
Meaning
An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.
Practice
update ← download("trusted vendor")
Testing
Gaps
update = genuineUpdate hiddenMalware
Check Answer
Spots
1channel = "phishing_email"
2malicious = True

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Woodpecker' badge — Tap Tap Tap, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A supply chain attack hides malicious code in a trusted supplier's software update. Which statement describes it best?
A. Attackers slip bad code into a genuine update, so users install it thinking it is safe ✓
B. Attackers send users a fake update link from a made-up company
The key idea is that the update comes from a real, trusted supplier. The attacker tampers with it before it reaches users.
2. In a compromised update attack, how does the malicious code usually reach users?
A. Through a random pop-up from an unknown website
B. Through the supplier's legitimate update channel ✓
The attacker uses the normal, trusted update channel. That is why users and their devices let it through.
3. Why do users install a compromised update without suspicion?
A. It appears to come from a supplier they already trust ✓
B. It is always labelled as malware
Trust is what the attacker exploits. The update looks normal and arrives the usual way, so users have no reason to doubt it.
4. SolarWinds case study: where did attackers insert their malicious code?
A. Into a phishing email sent to every customer
B. Into a genuine update of the Orion network management software ✓
In the SolarWinds attack, criminals tampered with Orion software updates. Thousands of customers then installed the update as normal.
5. SolarWinds case study: why was the attack so hard to spot at first?
A. The update came from the real supplier through its normal channel ✓
B. The update came from an unknown sender with spelling mistakes
The compromised update was delivered by the real company, so it looked genuine to customers and to many security tools.

Match the Pairs

Supply chain attack → Criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.
update.exe from vendor server → A legitimate update channel that an attacker can misuse as the path to deliver malicious code.
In the SolarWinds attack, attackers slipped malicious code into a genuine software update that customers then installed. → Orion update + hidden backdoor = trusted install
Keeping software updated is still advised, because most updates fix real vulnerabilities and compromised ones are rare. → if update_from_trusted_vendor: install_it()
if file_from_vendor: assume_safe = True → Assuming an update is safe just because it comes from a trusted vendor. A supply chain attack hides malicious code inside a genuine update.
Never install updates, they might be hacked → Refusing all updates because of supply chain attacks. This leaves known vulnerabilities unfixed and makes attacks easier.

Key Term

Supply chain attack
An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

Fill in the Blanks

1. update = genuineUpdate + hiddenMalware
Hint: Type the operator that joins the hidden malicious code onto the genuine update.
2. userTrustsUpdate = TRUE
Hint: Type the Boolean value showing that users believe the update is safe.
3. IF source == "vendor" THEN install(update) END IF
Hint: Type the comparison operator that checks whether the update appears to come from the trusted supplier.
4. FOR EACH customer IN customers send(update, customer) END FOR
Hint: Type the keyword that links the loop variable to the list, like one poisoned update reaching many customers.
5. IF updateVerified THEN install(update) END IF
Hint: Type the function name that adds the update once it has passed checks, since keeping software updated is still advised.

Spot the Error

Question 1
A channel = "phishing_email"
B malicious = True
C if malicious:
D print("Attack!")
Line A — In a supply chain attack the malicious code travels through the vendor's official update channel, not a phishing email. Line 1 should be channel = "official_update".
Question 2
A update = get_update(vendor)
B if update.signed == False:
C install(update)
Line B — This would install the update only when it is NOT signed, which skips an important safety check. Line 2 should be if update.signed == True: so only signed updates are installed.
Question 3
A vendor = "SolarWinds"
B year = 2020
C customers = 18
D print(vendor, customers)
Line C — About 18,000 customers installed the compromised SolarWinds update, not 18. Line 3 should be customers = 18000.
Question 4
A patches = ["fix1", "fix2"]
B for p in patches:
C check_signature(p)
D install(patches)
Line D — The loop checks one patch at a time, so each one must be installed after its check. Line 4 should be install(p), not the whole list.
Question 5
A vendor_ok = True
B sig_ok = True
C if vendor_ok or sig_ok:
D install_update()
Line C — With or, passing just one check is enough to install, which is how a trusted-looking update could slip through. It should use and so both checks must pass.

Student with a class code? Join your class →