chain
-
Blog
Tech Tariff Exemptions Are Temporary, Looking at ‘Whole Electronics Supply Chain’
U.S. President Donald Trump. Image: Gage Skidmore/Creative Commons U.S. President Donald Trump and his team have stated that the reciprocal tariff exemptions on electronic products are temporary. The administration excluded smartphones, computers, semiconductors, and other tech items from the 125% tariff on Chinese imports on April 11. Trump said his team is taking a look at the “whole electronics supply…
Read More » -
Blog
AI-hallucinated code dependencies become new supply chain risk
A new class of supply chain attacks named ‘slopsquatting’ has emerged from the increased use of generative AI tools for coding and the model’s tendency to “hallucinate” non-existent package names. The term slopsquatting was coined by security researcher Seth Larson as a spin on typosquatting, an attack method that tricks developers into installing malicious packages by using names that closely…
Read More » -
Blog
Revealing a Sophisticated Malware Delivery Chain
The Acronis Threat Research Unit (TRU) was presented with an interesting threat chain and malware sample for analysis that involved a known cyberthreat along with some interesting twists in targeting and obfuscation. In this article, we’ll dissect the complex malware delivery chain and tactics. The focus will be on a multi-stage infection process involving Visual Basic Script (VBS), a batch…
Read More » -
Blog
GitHub Action hack likely led to another in cascading supply chain attack
A cascading supply chain attack that began with the compromise of the “reviewdog/action-setup@v1” GitHub Action is believed to have led to the recent breach of “tj-actions/changed-files” that leaked CI/CD secrets. Last week, a supply chain attack on the tj-actions/changed-files GitHub Action caused malicious code to write CI/CD secrets to the workflow logs for 23,000 repositories. If those logs had been…
Read More » -
Blog
Supply chain attack on popular GitHub Action exposes CI/CD secrets
A supply chain attack on the widely used ‘tj-actions/changed-files’ GitHub Action, used by 23,000 repositories, potentially allowed threat actors to steal CI/CD secrets from GitHub Actions build logs. The GitHub Action is a very popular automation tool designed for GitHub Actions workflows. It allows developers to identify files changed in a pull request or commit and take actions based on…
Read More » -
Blog
Organizations urged to act fast after GitHub Action supply chain attack
More than 20,000 organizations may be at risk following a supply chain attack affecting tj-actions/changed-files GitHub Action. GitHub Actions is a continuous integration and continuous delivery (CI/CD) service that enables developers to automate software builds and tests. Workflows are triggered by specific events, for example when new code is committed to the repository. Used in more than 23,000 repositories, tj-actions/changed-files…
Read More » -
Blog
Why supply chain oversight is critical for business
All businesses, from the smallest ventures to the largest enterprises, have supply chains and a need for supply chain oversight. Whether it’s the raw materials made into the product you sell, or the office equipment and software you procure for your service-based business, you’ll always have dependencies and a need to maintain oversight over your personal supply chain. In any…
Read More » -
Blog
Microsoft launches genAI sales agents that focus on finance and supply chain – Computerworld
Salespeople spend hours verifying leads, writing to customers and then waiting for responses, said Bryan Goode, corporate vice president for business applications and platforms at Microsoft. “If you can take something that used to take hours and do it in minutes, you can spend more time selling,” he said. One agent, called “sales chat,” can automatically create documents by drawing…
Read More » -
Blog
What are the impact of tariffs on tech and will we see another semiconductor supply chain crisis?
The uncertainty around the impact of tariffs is stark right now, with those in the tech sector far from alone in wondering how they might be affected by sweeping taxes on imports. First on the campaign trail and now in office, the Trump administration has repeatedly sung the praises of tariffs and, at time of publication, is in the process…
Read More » -
Blog
Abandoned S3 buckets could have caused a catastrophic supply chain attack – and all at a cost of just $400
Abandoned cloud storage buckets were ripe to be taken over by cyber criminals and used to conduct a supply chain attack that would have dwarfed the 2020 SolarWinds incident, according to new research. A report from watchTowr Labs demonstrated how attackers could potentially exploit unused cloud storage buckets to gain access to sensitive networks of national governments, militaries, and major…
Read More »