A vendor update for the parking-meter backend includes a trojanized installer. What is the attack vector?
Select an answer to reveal the explanation.
Short Explanation
The city did the responsible thing and installed the vendor's own updater—and the updater was the payload. That is a software supply-chain vector, not a random PDF click. Trust in the parking-meter publisher was the path in.
Full Explanation
A vendor update for the parking-meter backend that includes a trojanized installer is a software supply-chain compromise of a trusted vendor update. The city did the responsible thing and installed the vendor's own updater—and the updater was the payload. Civic trust in the parking-meter publisher was the path in, which is why supply-chain is the correct vector label. Defenders should not rewrite the story as a random PDF click, VPN password spray, or parking-lot USB without facts that match those vectors.
Calling it a staff member clicking a random PDF in email fails by concept: delivery is via a trusted vendor update mechanism, not a random mail attachment. Calling it a password spray against the parking-meter SSL-VPN fails by concept: authentication spraying against VPN is not described. Calling it a USB dropped next to a parking kiosk fails by concept: removable media is not the update path used to introduce the trojanized installer.
Exam caveat: Trojanized trusted vendor updater equals software supply-chain compromise.
Operational check: Quarantine affected meter backends, verify update signatures and publisher integrity with the vendor, hunt installer hashes and child processes in Enterprise Security, and require verified channels plus staging environments for future meter software updates.