Poisoning the software supply chain

To the indiscriminate and opportunistic attacker, breaking into a software package´s development and distribution site and waiting until unsuspecting users install it is more efficient than locating and hacking into users´ systems individually. Starting in 2002 and continuing in to 2003, we´ve seen new emphasis on this type of attack. All the recent activity has showcased the trend that attacks against open-source software distribution sites are increasing. The author looks at how softwares distribution-both open source and proprietary-can invite attacks.