- Nov 5, 2011
- 5,855
Software Supply Chain Attacks Gained Traction in 2017 and Are Likely to Continue
Software Supply Chain Attacks Gained Traction in 2017 and Are Likely to Continue
Blog-Supply-chain-image CrowdStrike.com sharp2 saturated crop 349x349.jpg
Meyers began his discussion of supply chain attacks by commenting, “This is probably the thing that keeps me up at night when I look at what has changed in 2017.” He goes on to explain that the industry has long talked about supply chain attacks as a potential vector. “In a lot of people’s minds, they were thinking of hardware and chips — like microprocessors. But what we found in 2017 was that software as a supply chain attack became something that was realistic and viable,” Meyers said.
Meyers stated that the magnitude of such an attack vector is what makes it so terrifying. Virtually every organization in the world, whether in the public or private sector, depends on third-party software, which can include a wide-range of applications. Imagine the multitude of different types of software used for accounting, HR and countless other specialized functions. He explained what makes things worse is that many of these programs were developed by small vendors that aren’t necessarily using the security development lifecycle (SDLC) process. SDLC is a step-by-step process designed to help developers build more secure software and ensure security compliance requirements are being met.
Software supply chain attacks are also challenging because the vulnerabilities in many of these software programs are difficult to detect. “The attackers are exploiting software and trust that existed well before the vulnerability is identified or the attack takes place. This makes it very difficult to nail down the problem or figure out how it occurred,” Meyers said. He explained that most organizations use legitimate software that updates automatically and silently — making it difficult to verify and see what activity is occurring. He also warned that the effectiveness of software supply chain attacks in 2017 puts the supply chain at greater risk going forward as these tactics are leveraged by more actors, particularly those associated with nation-states.
The CrowdStrike Falcon® Intelligence™ team analyzed a number of software supply chain attacks in 2017 that were tied to nation-state threat actors. The following is an overview of some major global incidents:
Software Supply Chain Attacks Gained Traction in 2017 and Are Likely to Continue
Blog-Supply-chain-image CrowdStrike.com sharp2 saturated crop 349x349.jpg
- March 20, 2018
- Michael Busselen
Meyers began his discussion of supply chain attacks by commenting, “This is probably the thing that keeps me up at night when I look at what has changed in 2017.” He goes on to explain that the industry has long talked about supply chain attacks as a potential vector. “In a lot of people’s minds, they were thinking of hardware and chips — like microprocessors. But what we found in 2017 was that software as a supply chain attack became something that was realistic and viable,” Meyers said.
Meyers stated that the magnitude of such an attack vector is what makes it so terrifying. Virtually every organization in the world, whether in the public or private sector, depends on third-party software, which can include a wide-range of applications. Imagine the multitude of different types of software used for accounting, HR and countless other specialized functions. He explained what makes things worse is that many of these programs were developed by small vendors that aren’t necessarily using the security development lifecycle (SDLC) process. SDLC is a step-by-step process designed to help developers build more secure software and ensure security compliance requirements are being met.
Software supply chain attacks are also challenging because the vulnerabilities in many of these software programs are difficult to detect. “The attackers are exploiting software and trust that existed well before the vulnerability is identified or the attack takes place. This makes it very difficult to nail down the problem or figure out how it occurred,” Meyers said. He explained that most organizations use legitimate software that updates automatically and silently — making it difficult to verify and see what activity is occurring. He also warned that the effectiveness of software supply chain attacks in 2017 puts the supply chain at greater risk going forward as these tactics are leveraged by more actors, particularly those associated with nation-states.
The CrowdStrike Falcon® Intelligence™ team analyzed a number of software supply chain attacks in 2017 that were tied to nation-state threat actors. The following is an overview of some major global incidents:
- NetSarang/CCleaner: Both of these back-door attacks on legitimate applications point to China-nexus threat actors, and used the technique of compiling malware directly into the compromised software. In CCleaner, the attacker modified a function so the execution flow was routed to a custom function meant to decode and load the malware. The intel team observed that NetSarang delivered PlugX linked to WICKED PANDA. Similarities between these attacks, such as command-and-control tactics and code overlaps, suggest they are connected to the same threat actor.
- M.E. Doc: This attack was aimed at a tax-accounting application, M.E. Doc, made by a Ukrainian company, and began when threat actors comprised the company’s update server and sent NotPetya to unsuspecting victims. XDATA ransomware was also distributed via M.E. Doc in June 2017 and possibly as early as April, when access to the infected update services became available.
- PyPi: This attack compromised the popular Python programming language by replacing libraries on PyPi servers with packages altered to include a check-in beacon. Although the attribution for this attack remains unclear, Falcon Intelligence analysis suggests this was possibly a proof-of-concept or gray-hat incident. Regardless of its origins, it underscores the supply chain threat to user-curated systems.
- Watch the on-demand webcast: CrowdStrike 2018 Global Threat Report
