SupplyChain Archives - CyberConvoy Blog

Microsoft PowerShell Gallery vulnerable to spoofing, supply chain attacks

Users of the PS Gallery repository are advised to adopt policies that allow execution of only signed scripts

26 August

Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack

It is possible to take over retired organizations or user names and publish trojanized versions of repositories to run malicious code

24 June

3CX Desktop App found to be trojanized in a Supply Chain Attack

A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is reportedly being used to target the company's customers in an ongoing supply chain attack

30 March

Python Developers Warned of Trojanized PyPI Packages Mimicking Popular Libraries

The 41 malicious PyPI packages have been found to pose as typosquatted variants of legitimate modules such as HTTP, AIOHTTP, requests, urllib, and urllib3

23 February

Microsoft-signed malicious Windows drivers used in ransomware attacks

12/16/2022
Cyber News
Exploit, Hacking, Patching, Ransomware, SupplyChain

Microsoft has revoked several Microsoft hardware developer accounts after drivers signed through their profiles were used in cyberattacks, including ransomware incidents

16 December

Dell, HP, and Lenovo Devices Found Using Outdated OpenSSL Versions

12/03/2022
Cyber News
Hardening, PrivEsc, Security, SupplyChain

An analysis of firmware images across devices from Dell, HP, and Lenovo has revealed the presence of outdated versions of the OpenSSL cryptographic library, underscoring a supply chain risk

3 December

NSA and CISA share tips to secure the software supply chain

09/10/2022
Cyber News
Hardening, Security, Software, SupplyChain

Developers will find helpful guidance from NSA and partners on developing secure code, verifying third party components, hardening the built environment, and delivering the code. Until all DevOps is DevSecOps, the software development lifecycle will be at risk

10 September