Compromised software updates

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A supply chain attack hides malicious code in a trusted supplier's software update. Which statement describes it best?

A Attackers slip bad code into a genuine update, so users install it thinking it is safe

B Attackers send users a fake update link from a made-up company

2. In a compromised update attack, how does the malicious code usually reach users?

A Through a random pop-up from an unknown website

B Through the supplier's legitimate update channel

3. Why do users install a compromised update without suspicion?

A It appears to come from a supplier they already trust

B It is always labelled as malware

4. SolarWinds case study: where did attackers insert their malicious code?

A Into a phishing email sent to every customer

B Into a genuine update of the Orion network management software

5. SolarWinds case study: why was the attack so hard to spot at first?

A The update came from the real supplier through its normal channel

B The update came from an unknown sender with spelling mistakes

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Supply chain attack		Aif update_from_trusted_vendor: install_it()
2update.exe from vendor server		BA legitimate update channel that an attacker can misuse as the path to deliver malicious code.
3In the SolarWinds attack, attackers slipped malicious code into a genuine software update that customers then installed.		COrion update + hidden backdoor = trusted install
4Keeping software updated is still advised, because most updates fix real vulnerabilities and compromised ones are rare.		DAssuming an update is safe just because it comes from a trusted vendor. A supply chain attack hides malicious code inside a genuine update.
5if file_from_vendor: assume_safe = True		ERefusing all updates because of supply chain attacks. This leaves known vulnerabilities unfixed and makes attacks easier.
6Never install updates, they might be hacked		FCriminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

Definitions

Supply chain attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

update = genuineUpdate _ hiddenMalware

userTrustsUpdate = ____

IF source __ "vendor" THEN install(update) END IF

FOR EACH customer __ customers send(update, customer) END FOR

IF updateVerified THEN _______(update) END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A channel = "phishing_email"

B malicious = True

C if malicious:

D print("Attack!")

Question 2

A update = get_update(vendor)

B if update.signed == False:

C install(update)

Question 3

A vendor = "SolarWinds"

B year = 2020

C customers = 18

D print(vendor, customers)

Question 4

A patches = ["fix1", "fix2"]

B for p in patches:

C check_signature(p)

D install(patches)

Question 5

A vendor_ok = True

B sig_ok = True

C if vendor_ok or sig_ok:

D install_update()

Answer Key

Compromised software updates

Section A: Quick Questions

A — Attackers slip bad code into a genuine update, so users install it thinking it is safe

B — Through the supplier's legitimate update channel

A — It appears to come from a supplier they already trust

B — Into a genuine update of the Orion network management software

A — The update came from the real supplier through its normal channel

Section B: Match the Pairs

Supply chain attack → Criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

update.exe from vendor server → A legitimate update channel that an attacker can misuse as the path to deliver malicious code.

In the SolarWinds attack, attackers slipped malicious code into a genuine software update that customers then installed. → Orion update + hidden backdoor = trusted install

Keeping software updated is still advised, because most updates fix real vulnerabilities and compromised ones are rare. → if update_from_trusted_vendor: install_it()

if file_from_vendor: assume_safe = True → Assuming an update is safe just because it comes from a trusted vendor. A supply chain attack hides malicious code inside a genuine update.

Never install updates, they might be hacked → Refusing all updates because of supply chain attacks. This leaves known vulnerabilities unfixed and makes attacks easier.

Section C: Definitions

Supply chain attack — An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

Section D: Fill in the Blanks

update = genuineUpdate + hiddenMalware

userTrustsUpdate = TRUE

IF source == "vendor" THEN
  install(update)
END IF

FOR EACH customer IN customers
  send(update, customer)
END FOR

IF updateVerified THEN
  install(update)
END IF

Section E: Spot the Error

A — In a supply chain attack the malicious code travels through the vendor's official update channel, not a phishing email. Line 1 should be channel = "official_update".

B — This would install the update only when it is NOT signed, which skips an important safety check. Line 2 should be if update.signed == True: so only signed updates are installed.

C — About 18,000 customers installed the compromised SolarWinds update, not 18. Line 3 should be customers = 18000.

D — The loop checks one patch at a time, so each one must be installed after its check. Line 4 should be install(p), not the whole list.

C — With or, passing just one check is enough to install, which is how a trusted-looking update could slip through. It should use and so both checks must pass.