The SolarWinds incident revealed the devastating power of supply chain attacks. As a core player in the global supply chain, organizations need to deeply understand and defend against these threats.
A supply chain attack is a technique where the attacker does not directly target the victim organization, but instead attacks through a vendor, software supplier, or service provider that the victim trusts. The attacker compromises that "trusted third party" and then exploits that trust relationship to infiltrate the ultimate target.
Primary supply chain attack types:
The attacker compromises the vendor's build pipeline and injects malicious code into legitimate software updates. Because the update carries the vendor's digital signature, security tools typically do not block it.
Attackers upload malicious packages to registries such as npm, PyPI, and RubyGems, or use "Dependency Confusion" attacks to make organizations automatically download malicious versions.
Compromising IT outsourcers, system integrators, or cloud service providers, then using those vendors' legitimate access rights to infiltrate all of their customers. MSPs (Managed Service Providers) are prime targets.
Russian APT29 (Cozy Bear) compromised SolarWinds' software build environment and planted a backdoor called SUNBURST inside the Orion platform update (a DLL file). Because the update carried a legitimate digital signature, over 18,000 organizations installed the tainted update — victims included the U.S. Treasury, Department of Commerce, NASA, and dozens of Fortune 500 companies. The attackers lurked undetected for nine months, exfiltrating data throughout.
North Korea's Lazarus Group first compromised a financial software company (Trading Technologies), used its infected packages to further compromise 3CX's build environment, and then poisoned the 3CX desktop communications software update. This was the first publicly confirmed "supply chain within a supply chain" attack in history, affecting over 600,000 business users worldwide.
The attacker "JiaT75" posed as an active contributor to the xz/liblzma compression library, spending two years building trust and gaining maintainer privileges, ultimately planting an SSH backdoor in the official release. Had it not been accidentally discovered by a Microsoft engineer, this backdoor could have been broadly deployed across Linux servers worldwide. This incident profoundly exposed the fragility of open-source software supply chains.
Taiwan occupies a unique position in the global supply chain — semiconductor manufacturing, PCB production, and electronic component manufacturing are all globally critical. This makes Taiwanese organizations highly attractive pivot points for supply chain attacks: compromising one Taiwanese semiconductor fab could open doors to the world's top technology companies.
Taiwan-specific supply chain risk factors:
An SBOM (Software Bill of Materials) is a detailed list of all components, dependencies, and their versions within a piece of software — analogous to the ingredient list on a food label. Following the SolarWinds incident, SBOMs have become a core tool in global supply chain security management.
Practical uses of SBOMs:
Mainstream SBOM formats include SPDX (Linux Foundation) and CycloneDX (OWASP). Organizations can use open-source tools such as Syft and Grype to generate SBOMs for their own software, and require suppliers to provide SBOMs for their products.
Organizations should establish a systematic Third-Party Risk Assessment (TPRA) process rather than relying on one-time questionnaires. Hexion's recommended assessment framework covers three dimensions:
Assess the sensitivity of the data the supplier accesses, depth of system access, and difficulty of replacement. High-risk suppliers require more rigorous evaluation.
Verify the security controls actually implemented by the supplier, including certifications such as ISO 27001 and SOC 2, and actual penetration test reports.
Assess whether residual risk is acceptable, and determine whether additional contractual security requirements or technical compensating controls are needed.
Beyond risk assessment, organizations need to deploy concrete technical controls to limit the blast radius of supply chain attacks:
Contact Hexion Networks for a tailored security assessment and solution designed for your organization.