A novel form of software supply chain attack has been uncovered by ethical hacker Alex Birsan, who managed to breach the systems of over 35 major tech companies, including Microsoft, Uber and Tesla, by taking advantage of a concept known as dependency confusion.
The new attack vector is particularly worrying as, unlike traditional typosquatting or brandjacking supply chain attacks, the targeted companies automatically downloaded the malicious packages and the breach did not require social engineering or human error to infiltrate private repositories.
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
