flawopen.com/보안 사고/SolarWinds SUNBURST

SUNBURST: 신뢰받던 빌드 파이프라인 자체가 최악의 취약점이 된 순간

Related reading

• The XZ Utils backdoor: the supply chain attack that took three years
• Shai-Hulud: the npm worm that published itself

출처 및 공식 보안 권고

• CISA — advisory AA20-352A on the SolarWinds Orion compromise
• NVD — CVE-2020-10148 detail
• US Securities and Exchange Commission — filings and enforcement records
• US Government Accountability Office — report on the SolarWinds and Exchange incidents
• CWE-1357 — Reliance on Insufficiently Trustworthy Component