Hackers using open-source software to attack supply chains nowadays, open-source software becomes the scapegoat

Hackers are continuously growing their cyberattack methods in various ways. The Advanced Persistent Threat (APT) is moving their target from enterprises’ cybersecurity to the supply chain. The cybersecurity team constantly ignores open-source software security issues. Therefore, it wins hackers' favor. The well-known provider of internet hosting for software development, GitHub, was hacked by hackers implanting malware in their source code. This attack was letting all developers who were using open-source code become helpers in creating backdoor programs for hackers unintentionally. When these back doors’ products are launched, they will be distributed on home networks, corporate networks, critical infrastructure, and so on. It will directly allow hackers to expand on the attacking area. On the manufacturer side, there will be a lot of following repairing work, also cost and reputation lost.

In fact, the above situation can be avoided as long as people improve their cyber-security knowledge which is putting cyber-security awareness into the development process before the product is launched. There is one cost-effective way, by using automated tools to identify the weaknesses of third-party open-source code during development, manage and repair the discovered weaknesses. As a result, it can successfully avoid becoming a security breach in the supply chain and reduce weaknesses from being exploited.