M02: Inadequate Supply Chain Security

📋 What Is It?

Inadequate Supply Chain Security occurs when mobile applications integrate vulnerable third-party libraries, SDKs, or components without proper security vetting. This includes using outdated dependencies, malicious packages, or components with known vulnerabilities. Mobile apps typically integrate 10-30+ third-party libraries, creating a significant attack surface.

M02 OWASP Rank

82% Apps with Vuln Deps

Varied Time to Exploit

⚠️ Common Exploits

Vulnerable Dependencies: Exploit known CVEs in outdated libraries
Malicious SDKs: Trojanized advertising or analytics SDKs
Typosquatting: Install malicious packages with similar names
Dependency Confusion: Private package names replaced with public malicious ones
Compromised Packages: Legitimate packages hijacked by attackers
Transitive Dependencies: Vulnerabilities in nested dependencies

🔴 Attack Flow

1. Developer integrates popular SDK
↓
2. SDK contains known vulnerability (CVE)
↓
3. Attacker identifies vulnerable version
↓
4. Exploits vulnerability in mobile app
↓
5. BREACH: RCE, data theft, or malware!

❌ Vulnerable Code

// Bad: Outdated vulnerable dependency (Android)
// build.gradle
dependencies {
    // VULNERABLE: Old version with known CVEs
    implementation 'com.squareup.okhttp3:okhttp:3.12.0'
    implementation 'com.google.code.gson:gson:2.8.5'
    
    // VULNERABLE: Using + for version (unpredictable)
    implementation 'com.example:untrusted-sdk:+'
    
    // VULNERABLE: No integrity verification
    implementation 'com.unknown:suspicious-library:1.0'
}

// Bad: No SDK verification (iOS)
// Podfile
pod 'AFNetworking', '~> 3.0'  # Outdated version
pod 'Alamofire', '4.5'      # Has known vulnerabilities

// Bad: Loading remote code without validation
public void loadPlugin(String url) {
    // VULNERABLE: No signature verification
    DexClassLoader loader = new DexClassLoader(
        downloadPlugin(url), getCacheDir(), null, getClassLoader()
    );
}
                

✅ Secure Code

// Good: Updated dependencies with verification (Android)
// build.gradle
dependencies {
    // Use latest stable versions
    implementation 'com.squareup.okhttp3:okhttp:4.12.0'
    implementation 'com.google.code.gson:gson:2.10.1'
    
    // Specific versions, no wildcards
    implementation('com.example:trusted-sdk:2.5.0') {
        // Exclude vulnerable transitive dependencies
        exclude group: 'org.apache.commons', module: 'commons-text'
    }
}

// Dependency verification with checksums
dependencyVerification {
    verify('com.example:trusted-sdk:2.5.0') {
        checksum = 'sha256:abc123...'
    }
}

// Good: SDK verification and monitoring
buildscript {
    repositories {
        // Use trusted repositories only
        google()
        mavenCentral()
        // Avoid unknown repositories
    }
}

// Good: Verify dynamic code loading
public void loadPlugin(String url) {
    File plugin = downloadPlugin(url);
    
    // Verify signature before loading
    if (!verifySignature(plugin, TRUSTED_PUBLIC_KEY)) {
        throw new SecurityException("Invalid plugin signature");
    }
    
    DexClassLoader loader = new DexClassLoader(
        plugin.getPath(), getCacheDir(), null, getClassLoader()
    );
}
                

✓ Prevention Checklist

Maintain inventory of all third-party dependencies
Use dependency scanning tools (OWASP Dependency-Check)
Keep all libraries updated to latest secure versions
Avoid using wildcards in dependency versions
Verify checksums/signatures of dependencies
Use only trusted package repositories
Review security advisories for used libraries
Implement Software Bill of Materials (SBOM)
Monitor for new vulnerabilities (CVE databases)
Remove unused dependencies to reduce attack surface

🔍 Detection & Tools

Analysis Tools:

OWASP Dependency-Check Snyk MobSF Checkmarx Sonatype Nexus JFrog Xray

CI/CD Integration:

GitHub Dependabot Renovate WhiteSource Black Duck Veracode

How to Test:

Extract dependencies from build.gradle or Podfile
Run dependency vulnerability scan (e.g., dependency-check)
Check CVE databases for known vulnerabilities
Analyze transitive dependencies for issues
Review SDK permissions and capabilities
Monitor SDK network traffic for suspicious behavior

🌍 Real-World Breaches

Log4Shell (2021): Log4j vulnerability affected countless mobile apps worldwide
Equifax (2017): Apache Struts vulnerability led to massive data breach
Chinese SDK Malware (2020): 1,200+ apps infected via malicious SDK
Codecov (2021): Supply chain attack compromised CI/CD pipelines
SolarWinds (2020): Compromised software updates affected thousands
event-stream (2018): NPM package hijacked to steal cryptocurrency

📌 Quick Tips

DO NOT use outdated dependencies with CVEs
DO NOT trust unknown SDK sources
DO NOT use wildcards in versions
DO scan dependencies regularly for vulnerabilities
DO maintain SBOM for all components
DO automate dependency updates with security checks

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.2
NIST 800-53 SA-12, SR-3
OWASP MASVS MSTG-CODE-5
ISO 27001 A.14.2.9
SSDF Supply Chain Security
Executive Order 14028 SBOM Requirements

🔗 Inadequate Supply Chain Security