The latest software library compromise of an obscure but popular file compression algorithm called XZ Utils shows how critical these third-party components can be in keeping enterprises safe and secure. As CSO reported last month, a hacker was able to take the long game and insinuate themselves into the open source maintainers and add a malware-laced backdoor into the utility.
What is chilling about this compromise is how the attacker gained the team’s trust and how surgically they inserted their backdoor to avoid detection. Granted, many third-party supply-chain attacks may have been more blunt and used simple brute force, but these library compromises represent a new front for security managers, especially since they combine three separate trends: a rise in third-party supply-chain attacks, hiding malware inside the complexity of open-source software tools, and using third-party libraries as another potential exploit vector of generative AI software models and tools. Let’s unpack each of these items.
