Leonardtown, Maryland, Town Administrator Laschelle McKay was going about her day one Friday this past July when she learned the town’s entire network was shut down.
It turned out the town’s IT company JustTech is a client of management and security software provider, Kaseya, which earlier had suffered an attack where hackers had gotten in and added malicious code to software the company had released for its customers to upload in an update. Kaseya’s VSA software platform is mainly used by other tech companies to monitor and manage customers’ IT networks.
JustTech sent an email to Leonardtown saying neither its “servers nor your network were directly hacked or breached. The intrusion came through the remote monitoring and security software we utilize from an industry leading provider.”
All but two of the town’s 19 computers were affected. JustTech said the ransomware gang REvil was demanding $45,000 per computer, but the town’s government never seriously considered paying. They instead proceeded to get back online utilizing computer backups. JustTech said it would be able to restore the town’s system, but it was unclear how long it would take.
RELATED STORIES
- Podcast: Managing the Supply Chain
- Cybersecurity: Foundation for Digital Transformation
- Podcast: Best Practices to Reduce Cyber Risk, Improve Digital Resilience
- Podcast: Project Bids and Cybersecurity
- Protecting Non-Critical Infrastructure
- Podcast: Cybersecurity in Non-Critical Industries
- Cybersecurity in the New Normal
- Podcast: Security in the New Normal
- New Ways of Working: Adapting to Reality through Digital Resilience
Violates Trust
A software supply chain attack occurs when an attacker infiltrates a software vendor’s network and deploys malicious code to compromise the software before the vendor sends it to their customers. That software can then further compromise customer data or systems. Among other things, this type of attack violates the level of trust between software supplier and its customer. Trust is the cornerstone of any relationship, especially when you’re talking about software. A customer has to believe the vendor is providing a solid, true product that does what it’s supposed to do. Once that trust ends up violated, whether on purpose or by accident, what happens next?
“The number of supply chain attacks is definitely increasing,” said Dee Kimata, global director of cybersecurity services at Schneider Electric. “And some of the why behind that is a lot of organizations will use third-party software and bundle it into a packaged offer in order to supply cybersecurity products and services to their end users. And when you follow that model and embed that third-party software, it opens up risk for supply chain cybersecurity attacks.”
Indeed, the European Union Agency for Cybersecurity (ENISA) forecast four times more software supply chain attacks in 2021 than in 2020. Like all cyber assaults, these attacks know no boundary, as cybercriminals shift to larger, cross-border targets.
In a report, ENISA found:
- Around 62 percent of the attacks on users took advantage of their trust in their supplier
- In 62 percent of the cases, malware was the attack technique employed
- When considering targeted assets, in 66 percent of incidents attackers focused on the suppliers’ code in order to further compromise targeted users
- Around 58 percent of the supply chain attacks aimed at gaining access to data (predominantly user data, including personal data and intellectual property) and around 16 percent at gaining access to people
While the Kaseya attack affected 70 managed service providers, resulting in more than 350 of their customers impacted, a bigger supply chain attack that still reverberates more than a year after it occurred was when SolarWinds fell victim to hackers getting in and adding malicious code to its software and were able gain access to as many as 18,000 customers.
Types of Attacks
SolarWinds fells victim to two out of the three types of supply chain attacks: Hijacking updates, undermining code signing, and compromising open source code.
“I think one of the reasons that the SolarWinds attack was so impactful is that it basically hits on two of those three,” Kimata said. “The hacker essentially got access to the update servers and understood what updates needed to be applied and injected the malware into the updates that went out to end user customers. So here, you’re seeing a little bit of the hijacking updates. Secondly, being able to elevate their level of access to inject it, and then being able to look authentic, so undermining that authenticity of the actual code. It was definitely an advanced persistent threat, which requires both intent, as well as the capability to create such a sophisticated attack.”
Attackers need to get access to the software supplier’s network to apply malicious code. There are several different methodologies for attackers to add malicious code to software.
“Compromising the code repository is one way and that’s where you can elevate your privileges,” Kimata said. “Secondly, passwords are typically used and reused frequently, so once within the network, by just using the same credentials, a malicious actor can then pivot and get more access to data and have a bigger amount of impact. For that specifically, having a password manager or requiring changes in passwords for various different systems is critical. Phishing is still a very big issue and phishing attacks have become more sophisticated. General training for people within the organization that may not be involved directly with coding or implementing cybersecurity controls so they can recognize that, ‘That doesn’t seem right. I’m not going to click on that’ can be done as well.”
Best Practices
The following are some best practices to help ward off a supply chain attack:
Supply chain risk-management requirements should have a section specifically related to cybersecurity. A checklist of requirements the vendor needs to meet.
Ensure the third-party supplier has a secure development lifecycle in place that includes some sort of code check or validation the code is clean.
Ensure the supplier’s principles about secure pure development framework and a vulnerability management process if something is found.
Safeguards around access management. Elevated access should definitely set off a trigger when it comes to a technology safeguard for ensuring or mitigating the risk of a cyberattack.
Relationship between organizations leveraging a third-party solution, when the actual incident happens, the end user often looks to the middleman for a response or support or guidance. Ensure the relationship between the solution provider and the third-party also has some safeguards is pretty critical as well.
— Gregory Hale
When the supplier is unaware of an attack and the end user blissfully downloads the software updates and unwittingly opens up a back door to their network, the clock just starts ticking.
Attack Timeframe
In the SolarWinds attack, it took well over a year from the time the hackers first entered the SolarWinds network until the breach ended up discovered.
The vulnerability ended up inserted within the SolarWinds Orion Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1, which, if present and activated, could potentially allow an attacker to compromise the server on which the Orion products run.
Added on top of that, the software was digitally signed which, in theory, protected the software’s integrity. Digital signing of a file is a way to tell the end-user the software is free from manipulation.
In terms of what attackers are looking for, Kimata said data in the OT space is very valuable, especially process information.
“In the OT space, we’ve seen some targeted attacks, specifically in the water segment. Another that’s really popular is in the energy segment. There’s a lot of talk around being more efficient around energy objectives, sustainability, those sorts of initiatives. And so, there is a lot of interest in the energy space.”
There are two elements that need addressing which are critical and unique around supply chain attacks, Kimata said.
“The first one is that with the supply chain attack, there’s an element of elevated privilege that needs to be granted in order for the malicious actor to move within a network. There’s usually some sort of mechanism to spread that malicious code in a quicker manner. The malware inserted at the update server means all end users are tapping into it getting the updates which then impacts their own systems and software, so there’s that greater reach because there’s a centralized location essentially for that malware to spread.
“There is also the level of communication between the end user networks, the third-party network, and then the intermediary reseller or the solution that’s embedded,” she said.
Understanding those two elements can help create – or restore – the level of trust.