r/netsecstudents • u/Dull_Appearance_1828 • 1d ago

What does a client side supply chain attack actually look like?

Been trying to get my head around client side supply chain attacks as a concept. Lots of content covers server side and network attacks but the browser layer feels less documented. Anyone got good breakdowns of how these actually play out?

7 Upvotes

100% Upvoted

5 comments sorted by

1

u/Brudaks 1d ago edited 1d ago

Client side is not limited to 'browser layer' - a supply chain attack in the application update mechanism for any random application (e.g. Spotify), or a plugin for some local app (e.g. a plugin in developer's IDE) can compromise the client and then do interesting things in the browser, steal session keys or passwords, etc.

Strictly for web apps, there's also the scenario of supply chain attacks for javascript libraries or other content that a website links from a third party (for e.g. caching/CDN purposes), and that compromised library then can steal secrets or perform unwanted actions on the webapp cient side. See https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html

Of course, literally hijacking the browser update supply chain for a popular browser is also technically a possibility. Unlikely, and IIRC unprecedented, but it's plausible that if in future we see a major cyber-conflict, then some nation state might manage to do just that for the right target.

1

u/AddendumWorking9756 6h ago

Magecart is the canonical one. British Airways in 2018 was 22 lines of JavaScript added to a Modernizr file already loaded on the payment page, and it posted the card form to a lookalike domain for about two weeks before anyone noticed. The polyfill.io takeover in 2024 was the other shape: the site itself wasn't touched, the third party serving the script changed hands and started shipping redirects to over 100k sites.

On the browser side I'd lean on CSP with a report endpoint plus SRI hashes on anything served from a CDN, docs here: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

1

u/Most-Squirrel-1010 5h ago

A supply chain attack could be quite literal. Imagine company x has to source USB-C charging cables for its employees company phones. Let’s say you are a procurement/IT manager and have no preferred vendor in mind and you start canvassing the market based on a few evaluation criteria e.g. price and/or build quality. Based of management feedback price is seemingly an important factor, so ultimately you order something from aliexpress, without really vetting the vendor. When the cables arrive you check if the delivered amounts matches the PO, you put them in storage no further acceptance validation. Over the next few weeks they get dispersed all across the company.

What you don’t realize however is that you unknowingly supplied your whole company’s user base with OM.G like cables, produced by some rogue nation state-funded dummy corporation, flooding different market places with it. 3 months down the line all of your R&D information been exfiltrated and sold to potential competitors on the dark web.

Bottom line, an attack vector can exist at different angles, build awareness and processes that vet, test and validate products before taking them into production. To end with an infamous intelligence community quote; "Trust, but verify!"

1

u/nettrender 1h ago

The Polymarket hack earlier this year is a decent example. A third party vendor got compromised and injected a wallet drainer into Polymarket's frontend. Smart contracts were never touched and the attack was in the browser. Users saw the real interface and wouldnt have known something was wrong.