Supply Chain Attacks

A Supply Chain cyber attack is a sophisticated type of cyberattack where malicious actors exploit vulnerabilities in an organization’s supply chain. Instead of attacking the organization directly, hackers compromise less secure third-party entities, such as vendors, service providers, or software suppliers, that are part of the supply chain. These trusted relationships offer a pathway for attackers to infiltrate the target and bypass its security defenses. Supply chain attacks are particularly dangerous because they exploit the interconnected nature of modern business ecosystems, often impacting multiple organizations at once.

Supply Chain Cybersecurity focuses on implementing security measures to address risks and protect against threats from third-party entities. It highlights the importance of assessing and securing the entire supply chain, including vendors, contractors, and software providers. Organizations can strengthen their defenses by adopting strategies such as Zero Trust Architecture (ZTA), continuous monitoring of third-party access, and thorough vendor risk assessments.

Cybersecurity Risks in the Supply Chain

The success of a business depends on its supply chain cybersecurity. As noted by the GAO-18-667T (GAO), reliance on supply chains introduces risks to federal information systems. Threats arise during various phases of an information system’s development life cycle, potentially creating significant cybersecurity risks.

For instance, attackers may take control of systems, disrupt operations, or cause a data breach. Social engineering tactics and buying products from untrusted distributors increase these risks. Without proper security awareness and response plans, organizations may experience breaches that expose personal information and sensitive credentials.

Complex Web of Supply Chain Vulnerabilities

Today, organizations have a greater choice of suppliers and have become more reliant on third parties. However, this also means the supply chain has become a more complex web of interdependent companies, many of which might not even be aware of their connections. As a result, it is impossible to cover the entire supply chain. Additionally, technology is becoming an essential tool in the supply chain cybersecurity for all operations. These factors combined, have precipitated an inadvertent expansion of supply chain vulnerabilities.

There are various actors who might target an organization’s supply chain attack. With that comes numerous motives behind an cyber attack. An individual looking to gain financial benefits. Or a nation-state or state-sponsored actor seeking to sabotage an adversary by conducting espionage.
In a supply chain attack, the hardware is typically tampered with. Human Interface Devices (HID) can be compromised at any point throughout the supply chain, and a Rogue Device, like bad USB, can be delivered by a supplier to the end user. Moreover, due to the interconnections of the involved organizations, suppliers often have access to a target’s sensitive information.

Supply Chain Hardware Based Attacks

Supply chain attacks are getting more complex, making it harder to detect and trace their origin. In many aspects supply chain attacks represent the “Holy Grail” of hardware based attacks. Additionally, implants can be microscopic and can easily go unnoticed to the human eye, avoiding any suspicion as to the device’s true intentions.
Cybersecurity software solutions do not detect physical layer implants. Furthermore, spoofed peripherals could gain authorization as genuine human interface devices (HID), thus evading security alarms. Ultimately, attacking the supply chain offers numerous benefits that are favorable for bad actors.

Vulnerabilities of the Supply Chain

Complex Supply Chain

A large supply chain makes detecting a supply chain attack more difficult because only a small number of devices may be compromised or tampered with. If an attack is detected, the subsequent investigation becomes extremely difficult due to the involvement of numerous players in the supply chain, including subcontractors, making it challenging to pinpoint the origin. Specialized tools are necessary, and a careful examination of intricate equipment is required. This situation is ideal for attackers as it lowers the risk of detection and punishment. Large supply chains also provide perpetrators with greater entry points so that if one supplier has strong security measures, there are others to infiltrate instead.

With more suppliers comes more employees. Insiders threats are often considered the greatest risk to a company’s cybersecurity either due to careless action which causes an attack, or from malicious insiders who act with intent. Carelessness is often the result of a lack of education and awareness regarding cybersecurity and how employees themselves can cause, or prevent, an attack from taking place simply through their actions. Malicious insiders might act out for opportunistic reasons or as a form of revenge against the organization. As such, the more individuals involved in the supply chain, the greater the risk of a successful cyber attack.

Foreign Suppliers

Organizations often work with suppliers located in other countries. This can provide attackers with useful information about the relationships between these countries, which can be exploited for cyberattacks. As cyberwarfare grows, it becomes easier for adversaries to launch attacks, and supply chain attacks are a common method for infiltrating organizations.

If a supplier operates within a country, that country’s government may be able to disrupt or stop an attack. However, if the supplier is based in a country with weaker cybersecurity regulations, it becomes easier for attackers to compromise them. Once an attacker infiltrates a supplier in a country with less strict rules, they can use that entry point to target organizations in countries with stronger security measures.

Insufficient Suppliers Cyber Security

Despite many countries heavily regulating cybersecurity and data management, there are still gaps in the efficacy of suppliers’ security features. Sometimes, financial constraints prevent suppliers from deploying highly sophisticated security features. Or certain aspects of cybersecurity remain uncovered by existing tools. It is impossible to know the security measures of all suppliers. An organization is only as strong as its weakest link. If a supplier has insufficient security, they could become the target of a supply chain attack. This would ripple through the entire supply chain or allow a manipulated device to pass through unintentionally.

Types of Supply Chain Attacks

Manipulation

Supply chain attacks often entail intercepting and manipulating hardware. This can include the manipulation of the printed circuit board (PCB). Bad actors inject malicious functionality after conducting a reverse engineering process to identify areas suitable for adding new capabilities. Additionally, they manipulate chips to execute attacks. In this scenario, everyday peripherals can be spoofed to act maliciously. While the chip retains its original functionality, an external event – either physical (by sending a specific RF signal) or logical (by accessing a typically nonexistent memory area) – can activate the “additional” functionality.
Manipulation can happen at any point throughout the device’s route along the supply chain. The device will be opened, changed, closed and put pack in transit.

Side Channel Attack

These attacks aim to extract secrets from a chip or system through measurement and analysis of physical parameters. Side channel attacks have proven to be successful in breaking algorithmically robust cryptography operations. Thus, conventional cryptographic methods no longer protect anything else.

Fault Attack

These attacks target a physical electronic device. The attacker essentially causes stress to the device through an external mean e.g. wrong voltage, excessive temperature or signal power interference. The stress generates errors in such a way that it results in a security failure of the system. This failure allows the bad actor to obtain faulty outputs or behaviors for the key recovery.

Power Line Attack

Through malware, perpetrators can control the workload of the device’s CPU. Thus having the ability to also control its power consumption. The attacker measures the emissions conducted on the power cables and processes the signal, decoding it back into binary information. By modulating changes in the current flow, bad actors can steal passwords, encryption keys, and other sensitive information, highlighting a vulnerability often exploited in supply chain attacks.

Wireless Implants

Computer operating systems have facilitated the acceptance of devices through the HID standard. Making it seamless to connect keyboards, mice, and other input devices simply by plugging them in. By exploiting this weakness, attackers have utilized devices that act like HIDs to carry out attacks. Since they will be recognized as genuine by the computer. These Rogue Devices look authentic to the human eye. Such as a charging cable or a keyboard – and are used by victims without questioning their intent (Juice Jacking). The device incorporates a remote access point, allowing the attacker to control the endpoint without needing physical access, making it an efficient method for executing supply chain attacks.

Spy Chips

These are malicious chips which can access the configurations of the target’s firewall. From this point, the attacker can change the firewall settings to enable remote access to the target device. Disable its security features, and access the device’s log of all connections it receives. Spy chips are tiny in size – just bigger than a grain of rice – and can go easily unnoticed on a motherboard. The activation of a spy chip can occur in one of two ways. Either as a “ticking time bomb” whereby it automatically activates after a certain period of time. Or through “cheat codes” which activate the chip based on input conditions. Therefore, someone could embed a spy chip long before it actually causes any damage.

Endpoint and Network Cybersecurity

Many times, IT and security teams struggle in providing complete and accurate protection of their network hardware assets. Especially in today’s extremely challenging IT/OT/IoT environment. This is because, often, there is a lack of device visibility which leads to weakened policy enforcement of hardware access. This vulnerability may result in security incidents, including supply chain attacks, ransomware attacks, data leakage, etc. To address this challenge, you need comprehensive visibility into your hardware assets. Regardless of device characteristics and the interface used for connection.

Moreover, malicious actors have adapted to the dynamic cybersecurity defenses deployed to block cyber-attacks by taking advantage of the “blind spots”. Mainly through bad USB HID-emulating devices or Physical Layer network implants. These Rogue Devices are covert by nature and go undetected by existing security software solutions, thereby leaving the organization extremely vulnerable to supply chain attacks.

Detect Supply Chain Cyber Attacks

Sepio’s platfom provide a panacea to the gap in network device visibility. As the leader in Rogue Device Mitigation, Sepio’s identifies, detects and handles all peripherals. No device goes unmanaged. Sepio uses Physical Layer fingerprinting technology and Machine Learning (ML) to calculate a digital fingerprint from the electrical characteristics of all devices and compares them against known fingerprints.

Sepio is able to provide organizations with ultimate device visibility and detect vulnerable devices and switches within the infrastructure. In addition to the deep visibility layer, a comprehensive policy enforcement mechanism recommends on best practice policy and allows the administrator to define a strict, or more granular, set of rules for the system to enforce. When a device breaches the pre-set policy, Sepio automatically instigates a mitigation process which instantly blocks unapproved or Rogue hardware.

See every known and shadow asset. Prioritize and reduce risks related to supply chain attacks. Schedule a demo to understand how to use Sepio’s patented technology to gain control of your asset risks.