A supply chain attack can potentially impact the global economy and bring it to a crashing halt. What happened with Crowdstrike, XZ Utils project and mitigation strategies for organisations to address supply chain attacks
Globalisation and digitalisation have made many aspects of the world economy heavily reliant on technology such as smartphones and notebooks which in turn are dependent on regular software and security updates from the manufacturers.
This intricate network of entities, resources, goods and services forms a supply mesh that enables international trade, travel and commerce as we know it today.
To enable these software updates, a certain level of implicit trust is afforded to a company when it pushes updates to their devices that they are free of malware and error. This implicit level of trust makes supply chain attacks a tempting prospect for threat actors.
By gaining access to a manufacturer’s infrastructure, threat actors are able to inject malware into legitimate software updates, making it potentially one of the most effective and dangerous attack vectors possible.
The recent Crowdstrike incident has demonstrated the significance of the supply chain and the unprecedented scale of an impact if something goes wrong, opening up new questions as to the vulnerability of supply chains and our dependency on them today.
The day the Earth stood still
Starting on Friday, July 19, 2024, 04:09 UTC for a span of approximately two to three days, the world economy ground to a halt thanks to a content configuration update released by CrowdStrike, a US-based cybersecurity company that is one of the few companies afforded with kernel privileges to the Windows operating system.
“The configuration update for Crowdstrike should have been a routine, a regular update to the protection mechanisms of their Falcon platform, gaining telemetry and detecting possible novel threat techniques for the Windows platform. Unfortunately, this update resulted in a never-ending reboot spiral for over 8.5 million Windows machines across the world,” said Cybersecurity expert of Global Research and Analysis team (GReAT) at Kaspersky, Vitaly Kamluk.
According to the media, critical infrastructure that had systems running Windows which were protected by Crowdstrike were affected by the erroneous update and unable to do business. At present, this could be considered as the worst outage in history with an unprecedented amount of financial damage.
Affected systems include Windows hosts running sensor version 7.11 and above that were online between Friday, July 19, 2024 04:09 UTC and Friday, July 19, 2024 05:27 UTC and received the update. Mac and Linux hosts were not impacted. Ultimately, this scenario was not instigated by any APTs but an erroneous software update that showed the potential aftermath of a perfectly executed supply chain attack.
Linux XZ – A wolf in sheep’s clothing brought to light
Earlier in 2024, the Linux XZ Utils project, a set of free data compression command-line tools and a library were found to be compromised in a supply-chain nature of attack.
The attack was a highly complex and sophisticated backdoor which was masterfully obfuscated and hidden to hook and tamper the logic of OpenSSH, an implementation of Secure Shell (SSH), to enable unauthorised access.
At present, tens of millions of home appliances connected to the Internet of Things (IoT), millions of servers, data centres and network equipment are reliant on SSH which can potentially lead to a catastrophe that would dwarf the Crowdstrike incident.
Open-source software company Red Hat noted that this incident is tracked in the NIST National Vulnerability Database as case CVE-2024-30942 with a maximum severity score of 10, acknowledging its potential for exploitation by malicious threat actors.
This incident was fortunately detected in time and research is ongoing but highlights that social engineering in combination with the nature of open source software remains another viable avenue for a supply chain attack.
Kaspersky experts conducted a comprehensive analysis of the case, which included examining the social engineering tactics involved.
What does the threat landscape bode for an AI-integrated future?
As with any technology, AI is not infallible as it is dependent on learning models and training to derive meaningful input and which can be subject to supply chain attacks by injecting malicious input. “Potential avenues of a supply chain attack on AI would be to manipulate the training data and introduce biases and vulnerabilities into the model or modify the AI models with altered versions so that it would produce incorrect outputs,” said Vitaly.
For APTs playing the long game, supply chain attacks can lie quietly waiting for the right target while potentially obfuscating the malware payload, hiding it as a legitimate file and placing extended tools within a trusted company’s infrastructure to facilitate higher level access or ultimately a full system compromise.
Far worse is the long term possibility of bugs or flaws being introduced into supply chain attacks focused on AI that would degrade its capabilities and quality over time, impacting crucial systems with a wide reach or critical importance.
Readily available large language model (LLM) AIs such as ChatGPT, CoPilot and Gemini can be manipulated to help in creating convincing spear phishing attacks while AI deepfakes can be used to mimic important personnel, which resulted in the loss of US$25 million in Hong Kong when a threat actor mimicked the image of a company’s chief financial officer to disburse the funds.
To address this potential threat landscape of supply attacks, organisations have a number of strategies. “In addition to best cybersecurity practices, organisations need to conduct mitigation strategies to manage or minimise the potential impact of a supply chain attack in their infrastructure,” said Vitaly.
Among the strategies are rigorous testing before builds go live, thorough tools integrity and strict manufacturing control, model version numbers and model validation to track changes and versions, continuous monitoring for anomalies, digital signatures for builds and regular security audits.
