Magazine menu Close Magazine menu

supply chain attacks

Latest stories

Cybersecurity expert Eliza-May Austin speaking while seated in a lecture theatre

How your air conditioning could start a cyberattack

  • min read
    • Many big businesses know they could be cybercrime targets and invest in defenses like software and training. That's why cybercriminals are increasingly attacking through smaller suppliers who don't have the same knowledge and resources. It's called a supply chain attack. In Tomorrow Unlocked's second episode in the hacker:HUNTER Behind the Screens series, Eliza-May Austin, CEO and co-founder of th4ts3cur1ty.company (That Security Company,) explains how US retail giant Target was attacked through a most unexpected device – the air conditioning. We ask Austin how businesses can prepare for supply chain attacks and how she thinks things are going for women in cybersecurity careers. In Tomorrow Unlocked's Hacker: HUNTER Behind the Screens video, you talk about the supply chain attack on Target in 2013. Why is this attack so important? Businesses must work with other businesses, which makes us all susceptible to a certain degree of risk. Take an airplane, for example. To go from concept to in the air involves hundreds of businesses, contractors and applications. It takes just one breach to compromise that trusted ecosystem. It's something we should all take seriously. Your business th4ts3cur1ty.company (That Security Company) helps companies large and small harden their supply chains. How do you do that? There are many things businesses can do to defend against supply chain attacks. For example, we run penetration testing, consult on governance, risk and compliance and importantly, logging, monitoring and vulnerability management. Are businesses becoming more aware of supply chain attacks and responding appropriately? I can't confidently say yes, which is why I'm vocal on the issue. I recently asked a small-to-medium company (SMB) that supplies services to the medical sector if they'd considered how an attack would impact their clients' security. I was met with such bemusement you'd think I'd asked for a sandwich. What's the most common problem making businesses vulnerable to supply chain attacks? Not knowing how prevalent it is. But also, some businesses that do understand the issue's scale get overwhelmed by it. These attacks aren't always sophisticated – simple measures can go a long way. How did you get into cybersecurity? I moved from a degree in forensic science to a degree in digital forensics, did some internships and the rest is history. You don't need a degree to be in cybersecurity. Is the industry giving women equal opportunities to enter and succeed yet? I think this industry, like any, is what you make of it. Cybersecurity is a fantastic career choice for women and should be promoted as such. What could employers do today to attract and retain more women? I get asked this a lot, so I wrote 15 ways to attract more women to your technical cybersecurity team. I've included simple, practical things like considering the physical environment. For example, if employees have to crawl around on the floor to plug in a laptop, that may feel degrading when wearing a skirt. I also recommend being more open-minded about what kind of people you need: What is Ladies Hacking Society (LHS) and why did you found it? LHS is an awesome community of women who come together to learn from one another and teach each other hacking. I wanted to create a technical option for women because I found mixed events were not really mixed (mainly men) whereas women's events revolved around governance or high-level theory. It's a lot of fun and a great bunch of people. Which is the most important lesson from your 11 leadership lessons from terrible managers, and why? Lesson 3: A sense of humor matters. People tend to take themselves too seriously. Encouraging people to laugh and joke does wonders for team morale and gets people through stressful times. Let's all calm down and have a giggle.  
evolution of supply chain attacks

Detection is better than cure: Seeing and preventing supply chain attacks

  • min read
    • Supply chain attacks represent something of a sea change among hackers. They're not new, but they're fast becoming more common, and evolving to evade detection. These attacks involve implanting the part of a virus that executes an attack (the payload) into components like software, firmware and hardware. That payload becomes part of the finished product. Companies that sell these products become unwitting distributors. They stow away silently on customers' computers or networks until something triggers their malicious processes. Here, we focus on software supply chain attacks, but it's worth a few words on the other two to understand the scale and scope of supply chain vulnerabilities. Hardware supply chain attacks Supply chain attacks on hardware are often crude and cheap. For example, implanting keyloggers in USB drives, capable of registering 8,000 pages of keystrokes, or inserting a microphone into Ethernet networking connectors (RJ45 plugs), stealing passwords and other sensitive data. Firmware supply chain attacks Hackers also tamper with firmware by embedding malicious code that enters customer devices. Boot firmware is often the target. By using the booting process, it only takes starting the hardware to execute the malware. Software supply chain attacks Hackers like software supply chain attacks because they only need to compromise one link in a long chain to smuggle malware everywhere. They can insert malicious code into software at several points during build, compilation, distribution and update. The increasing sophistication of enterprise software also increases the number of attack options. Attacks can target the software's source code, embedding malicious code in the build of a trusted app. Sometimes the code is embedded in an executable file with an infected compiler (a program that translates code from one language to another) or linker (a program that combines the data the compiler generates into one executable file). Another frequent target is software update mechanisms. While genuine software developers often 'sign' their executables and scripts with a digital certificate to give their identity and confirm the code is unaltered, supply chain attacks often include stolen certificates that seem genuine. Software developers dependent on open source code, usually smaller operators, are particularly vulnerable to supply chain attacks. Significant supply chain attacks Attacks that make their own a hit list Some supply chain attacks have used highly sophisticated pre-attack planning to identify suitable targets. Energetic Bear was one of the most significant attacks on critical infrastructure. It used an opening spear-phishing campaign to make a hit list of suppliers to target. Ghost in the app-creating tool Even Apple, famous for its virus resistance, fell victim to a supply chain attack. Hackers used Xcode, a tool for creating iOS and OS X apps, to smuggle malicious code into apps. Apple hosted these apps unwitting in its App Store. While developers usually download Xcode safely from Apple, it's also available on developer forums. Hackers embedded malicious code in these alternative sources. Researchers from Alibaba called these malicious variants 'XcodeGhost.' They contained just a few extra lines of code – hard to detect, but enough to penetrate. Backdoor in popular server management software The ShadowPad incident is one of the largest known and most sophisticated supply chain attacks. In 2017, Kaspersky researchers discovered a 'backdoor' (dubbed ShadowPad) planted in server management software used by hundreds of large businesses around the world. When activated, the backdoor lets attackers download further malicious modules or steal data. In this case, hackers had signed the malicious code with a legitimate certificate. The pointer to the infected function was also hidden from the user's view. The attackers had gained access not only to the certificates but also to the source code and build environment. Researchers in Kaspersky's Global Research and Analysis Team (GReAT) immediately notified the suppliers, NetSarang, who quickly pulled down the compromised software and replaced it with an earlier clean version. NetSarang proved that responding fast to cyberattacks makes a difference. Kaspersky and NetSarang found only one infected payload – an excellent result given the product's popularity. Cleaner attack goes right to the top CCleaner is a hugely popular system cleaner, downloaded more than two billion times. After a supply chain attack in September 2017, infected software was downloaded two million times. Hackers attacked through a tiny backdoor. They encrypted all strings, making them harder to detect. Like the ShadowPad attack, hackers signed their malicious code with legitimate digital certificates. These hackers wanted to get right to the top. They included a function in determining if the user had admin privileges. The attack would only continue if the user had access to the company's Command and Control function. Because the attack was highly selective, the full infection was downloaded only onto 40 computers. But the CCleaner infection's victims included some of the biggest names in enterprise tech – Samsung, Fujitsu, Intel, Sony and Asus. This made it one of the most damaging and effective supply chain attacks discovered. Hammering through automatic update functions Kaspersky researchers discovered the Operation ShadowHammer attack in January 2019. We found a suspicious file signed with a legitimate digital certificate from Asus. While distributed from Asus's official server, the files contained a sneaky backdoor. Supply chain attacks often target automatic update functions. At first, hackers planted Operation ShadowHammer's malicious code in Asus's live updater tool, but the mode of attack evolved over time. Operation ShadowHammer targeted more than 400 computers, with multiple unique backdoored samples. Asus was not the only target. Since our first discovery, we've identified several other cases, including digitally signed examples, from three other software businesses. Hackers signed backdoors with different certificates and chains of trust in each attack. Detection is better than cure Detecting supply chain attacks is nuanced work. Sometimes attacks don't directly manipulate original code, with updates downloaded and executed only in computing memory. Games are among the most attractive supply chain attack targets. Here, it's harder to know whether malware is part of the software's original functionality. For example, anti-cheating and IP protection mechanisms can trigger behavior analysis logics. Malicious code in supply chain attacks is only a tiny portion of code in an executable file. It's like trying to find a polar bear in a snowstorm. This is made harder by the valid code-signing certificates that often accompany the malicious code. How can businesses defend against supply chain attacks? Suppliers are softer targets than finished product vendors, partly because the final package is more extensive and complex. So what can businesses do about it? 1.      Use the best cybersecurity software Lightweight security solutions prioritize speed over rigor, leaving the risk of being fooled by supposedly legitimate code-signing certificates or mistaking suspicious files for false positives. Dedicated cybersecurity solutions do it better. A proven, corporate-grade security solution is essential for spotting and catching advanced targeted attacks. These analyze anomalies and give cybersecurity teams full visibility over their network, with an automated response. 2.      Hire the right team, and the red team Businesses should hire highly skilled information security personnel, including security specialists, SOC (security operation center) analysts and 'red teams.' 3.      Use threat modeling during software development During software development, companies must create a threat model for their development infrastructure to identify and eliminate risks in advance. Access models should apply the Principle of Least Privilege (PoLP) to restrict the risk of malicious access. 4.      Carefully manage supplier relationships Build trust that goes beyond traditional assumptions. 5.      Invest in response As we saw with NetSarang's rapid response to the ShadowPad attack, businesses must invest in response as well as protection. If you don't have internal capacity, involve an incident response team to investigate an incident or suspicious activity. Article published in 2019.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries