On January 19th, the maintainers of the popular PHP package management system disclosed that they had discovered a backdoor in an installer component named go-pear.phar. The PEAR website is still down as of today and maintainers state that they have no ETA for when a clean site will be on line. Although initial indications were […]
Archive | Software Supply Chain
Should Antivirus software be part of your threat model?
Antivirus Cyber Threat Intelligence Kaspersky Software Supply Chain Threat ModelShould Antivirus (AV) software be part of your threat model? Strictly speaking, yes it probably should be. AV is potentially dangerous to an organization and should be tested thoroughly before being deployed. As argued in the recent WSJ article about Kaspersky (note that the article is behind a pay wall), AV software could threaten the […]
Software plugins/extensions should be part of your threat model
Cyber Threat Intelligence Security Monitoring Software Supply Chain Threat ModelOver the last few months we’ve seen multiple cases of warnings about plugins and extensions for various software packages threatening the security of users. We’ve recently seen the Copyfish and and Web Developer Chrome plugins compromised and used to push malware to users. While Chrome is likely safe and should probably not be considered a […]