Supply Chain Compromise
|Supply Chain Compromise|
|Data Sources||Web proxy, File monitoring, Detonation chamber, Digital signatures|
Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment.
Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.
F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex.1 The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).
- Dragonfly 2.0 trojanized legitimate software to deliver malware disguised as standard windows applications.2
- XENOTIME targeted several ICS vendors and manufacturers.3
- The Backdoor.Oldrea RAT is distributed through trojanized installers planted on compromised vendor sites.4
- Code Signing - When available utilize hardware and software root-of-trust to verify the authenticity of a system. This may be achieved through cryptographic means, such as digital signatures or hashes, of critical software and firmware throughout the supply chain.
- Update Software - A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
- Audit - Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.
- Vulnerability Scanning - Implement continuous monitoring of vulnerability sources. Also, use automatic and manual code review tools.5
- F-Secure Labs. (2014, June 23). Havex Hunts For ICS/SCADA Systems. Retrieved October 21, 2019.
- Symantec. (2017, September 6). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 14, 2017.
- Dragos Threat Intelligence. (2019, August). Global Oil and Gas Cyber Threat Perspective. Retrieved January 3, 2020.