Talk:Supply chain attack

This article is rated C-class on Wikipedia's content assessment scale. It is of interest to the following WikiProjects:

Business Mid‑importance Business portal This article is within the scope of WikiProject Business, a collaborative effort to improve the coverage of business articles on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks. Mid This article has been rated as Mid-importance on the project's importance scale. Cryptography: Computer science Low‑importance This article is within the scope of WikiProject Cryptography, a collaborative effort to improve the coverage of Cryptography on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks. Low This article has been rated as Low-importance on the importance scale. This article is supported by WikiProject Computer science (assessed as Low-importance). Systems: Systems Mid‑importance Systems science portal This article is within the scope of WikiProject Systems, which collaborates on articles related to systems and systems science. Mid This article has been rated as Mid-importance on the project's importance scale. This article is within the field of Systems. Computing: Software / Security Low‑importance This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks. Low This article has been rated as Low-importance on the project's importance scale. This article is supported by WikiProject Software (assessed as Mid-importance). This article is supported by Computer hardware task force (assessed as Low-importance). This article is supported by WikiProject Computer security (assessed as High-importance). Things you can help WikiProject Computer security with: edit history watch purge Article alerts are available, updated by AAlertBot. More information... Review importance and quality of existing articles Identify categories related to Computer Security Tag related articles Identify articles for creation (see also: Article requests) Identify articles for improvement Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc. Find editors who have shown interest in this subject and ask them to take a look here.

Wiki Education assignment: Issues in Technology and Security

This article was the subject of a Wiki Education Foundation-supported course assignment, between 17 January 2023 and 6 May 2023. Further details are available on the course page. Student editor(s): Kyle-kelley-7 (article contribs).

— Assignment last updated by Kyle-kelley-7 (talk) 14:01, 2 April 2023 (UTC)[reply]

Wiki Education assignment: The Rhetoric of Archival Exploration

This article was the subject of a Wiki Education Foundation-supported course assignment, between 24 September 2024 and 6 December 2024. Further details are available on the course page. Student editor(s): Redisnowmyfavcolor (article contribs).

— Assignment last updated by Redisnowmyfavcolor (talk) 06:13, 2 December 2024 (UTC)[reply]

History of these attacks

It may be good if someone knows the history of these attacks to put it in.

Arguably the beginning of this theme was the famous paper Reflections on Trusting Trust, but I can't recall anything big before the OpenSSH trojaned distribution files in 2002. I'm sure it wasn't the first though, there were almost definitely trojaned software distributions on BBSs and early internet FTP sites throughout the 1990s, possibly some compromised package repositories, though this I'm less sure about.

I did a bit of digging and found the Michelangelo virus in 1992, which might count as the first? It seems some legitimate hard drives or software were shipped with it pre-installed. The "AIDS Trojan" around 1989 was distributed via mail at an AIDS conference, though that might be more social engineering than supply chain.

After the OpenSSH incident, the major attacks are a bit more well documented, including the 2008 credit card thing, the Target attack in 2010, and Dragonfly in 2013. The term itself appeared around this time so it's been hard for me to get information from before 2010. Would appreciate anyone with the information and willingness to share! 79.148.199.46 (talk) 14:47, 11 October 2025 (UTC)[reply]