How did hackers hide inside a trusted software update?

Hackers hid inside a trusted software update by breaking into the company that makes the software, not the customers. If you can slip your own code into the next official release, every customer who installs it does the work for you, and to them it looks like an ordinary update from a vendor they already trust. That is a supply chain attack: an attack on an organization by way of a less secure part of its supply chain.

A striking example is SolarWinds. The company made Orion, network management software used widely by governments and businesses. Attackers got into SolarWinds' build system, the place where updates are put together, and quietly modified the updates it sent out. From March 2020, customers who installed an update also installed a hidden piece of malicious code. It stayed dormant for 12 to 14 days, then phoned home, and its messages were designed to look like ordinary SolarWinds traffic.

The scale was huge, but the attackers were patient and picky. About 18,000 public and private organizations were affected, yet they appear to have used only a small fraction of the infections, the ones inside high-value targets. Fewer than ten US government agencies were confirmed compromised. The hackers had access for eight to nine months before anyone noticed, and the security firm FireEye found the trail while investigating its own breach.

For defenders it is an uncomfortable lesson: a valid update from a known vendor is not proof of safety. The response was drastic. US authorities ordered affected agencies to disconnect the compromised machines and rebuild them from trusted sources. The weakest link in the chain can be whoever you rely on.