2024 Open Source Security Report: Slowing Progress and New Challenges for DevSecOps
SolarWinds (2020) Supply Chain Attack — Summary What happened: A nation-state-level supply chain attack where hackers compromised SolarWinds' Orion software, inserting a backdoor (SUNBURST malware) into official software updates. Method: Attackers (linked to Russian APT29/Cozy Bear) inserted malicious code into Orion updates (v2019.4.5220 to v2020.2.1 HF1), which were downloaded by ~18,000 customers. The malware stayed dormant, then contacted command-and-control servers and enabled lateral movement across networks. Impact: Breached U.S. government agencies (DHS, Treasury, Commerce), tech companies (Microsoft, FireEye), and many private sector organizations. It exposed critical systems and led to widespread espionage. Key Lessons: Trust in software updates can be exploited. Highlights the need for supply chain security, zero trust architecture, cloud monitoring, and use of Software Bill of Materials (SBOM). Detection requires behavioral monitoring beyond signature-based tools.
Codecov (2021) Supply Chain Attack — Summary What happened: Attackers compromised Codecov’s Bash Uploader script, a tool used by developers to upload code coverage reports, and modified it to exfiltrate sensitive environment variables (like API keys, credentials, tokens). Method: Attackers gained access to Codecov’s Docker image building process using leaked credentials. They modified the Bash Uploader script to send environment variables to a remote server. The malicious version was live for over 2 months (Jan 31 – Apr 1, 2021). Impact: Thousands of organizations using the script unknowingly leaked secrets and credentials. Affected companies included HashiCorp, Twilio, and Rapid7. Attackers may have accessed private source code and internal systems through stolen credentials.