flawopen.com/安全事件/SolarWinds SUNBURST

SUNBURST：当软件发布管道本身成为最致命的攻击跳板

Related reading

• The XZ Utils backdoor: the supply chain attack that took three years
• Shai-Hulud: the npm worm that published itself

参考资料与权威通告

• CISA — advisory AA20-352A on the SolarWinds Orion compromise
• NVD — CVE-2020-10148 detail
• US Securities and Exchange Commission — filings and enforcement records
• US Government Accountability Office — report on the SolarWinds and Exchange incidents
• CWE-1357 — Reliance on Insufficiently Trustworthy Component