Supply Chain Vulnerabilities Flashcards

An attack that targets an organization's external partners — service providers, hardware manufacturers, or software vendors — rather than attacking the target directly. Attackers compromise a weaker link in the supply chain and use the trusted relationship to gain access to the ultimate target. Effective because organizations must extend trust to partners with legitimate access. One exploit in the chain can propagate to every connected organization.

Fazio Mechanical Services — an HVAC contractor. Not Target Corp itself. The attackers phished Fazio, stole VPN credentials used by HVAC technicians to access Target's network, and used those credentials to pivot into Target. Because Target's network was not properly segmented, the HVAC vendor access path reached production POS systems in 1,800 stores. 40 million credit card numbers were stolen (November 2013). The HVAC company was the weaker link; Target was the prize.

A supply chain attack technique where the attacker compromises a less-defended supplier or partner of the intended target, then uses that trusted relationship to "hop" into the hardened target organization. Named for WWII island-hopping campaigns that used smaller bases to reach larger targets. The attacker's goal from the start is the final target — the supplier is just the stepping stone. Target/HVAC is the textbook example: HVAC firm (weak) → Target Corp (strong, the real goal).

The SolarWinds Orion build pipeline — the automated system that compiled and packaged software updates. Attackers inserted the SUNBURST backdoor into the Orion update source before compilation. The malicious update was then compiled, signed with SolarWinds' legitimate code-signing certificate, and distributed to approximately 18,000 customers through the normal update mechanism (March and June 2020). The attack was undetected for nine months (discovered December 2020).

Because code signing proves who signed the code, not that the code is safe. Attackers compromised the SolarWinds build pipeline before the signing step. SolarWinds' own developers unknowingly compiled and signed already-malicious code using their legitimate certificate. The signature was completely valid — it genuinely came from SolarWinds. Signature verification confirmed "SolarWinds signed this" — it had nothing to say about whether the code itself was backdoored. Code signing is necessary but not sufficient against build pipeline compromises.

SUNBURST used multiple techniques to avoid detection: (1) Dormancy period — code waited 12–14 days after installation before activating, avoiding detection by test environments that don't run deployed code for extended periods. (2) Environment detection — code checked for security tools, sandbox indicators, and domain names associated with AV companies; it remained dormant if any were found. (3) Traffic blending — C2 communication used DNS queries and HTTPS traffic that mimicked normal SolarWinds telemetry. (4) Legitimate infrastructure — used domains named to resemble legitimate SolarWinds services.

Hardware sold as genuine that is actually manufactured without authorization — often using inferior or unverified components. Security risks: (1) Unknown vulnerabilities not present in genuine products. (2) Potential hidden backdoors for remote access or monitoring. (3) Different firmware than the genuine product — may lack security features or contain malicious code. (4) Physical failure (some caught fire). Network equipment (switches, routers, firewalls) is the highest-risk category — counterfeit devices carry all network traffic and could silently monitor or intercept it. Real case: $1B+ counterfeit Cisco scheme (arrested July 2022).

Two reasons: (1) Access — service providers often have legitimate, direct access to client internal systems (VPN tunnels, service accounts, read access to directories, remote management tools). An attacker who compromises the provider inherits that access. (2) Security disparity — service providers, especially small contractors (HVAC companies, payroll processors), often have significantly weaker security than the organizations they serve. Attacking the weak link is easier than attacking the hardened target directly. One service provider serving 20 clients is a 20-for-1 opportunity for an attacker.

A machine-readable inventory of all components, libraries, and dependencies that make up a software application. When a vulnerability is disclosed in an open-source library, an organization with SBOMs can immediately query: "which of our applications use this library?" and get an answer in minutes. Without SBOMs, answering the same question may require weeks of manual investigation. SBOMs became a requirement for U.S. federal software suppliers after the 2021 Executive Order on Cybersecurity, driven by the supply chain visibility problems exposed by SolarWinds and Log4Shell.

Service providers: (1) Security audit requirements in vendor contracts, reviewed periodically. (2) Network segmentation — vendor accounts access only required systems. (3) Behavioral monitoring for anomalous vendor credential use. Hardware: (4) Purchase only from authorized distributors. (5) Verify hardware authenticity before deployment. Software: (6) Verify digital signatures on all installs. (7) Stage updates through test environments before production. (8) Maintain SBOM for dependency visibility. All layers: (9) Apply least-privilege to vendor accounts and monitor for anomalies.