Cyberinsights: Talking about the Software Supply Chain

I'd like to return to my initial point, which is understanding the importance of the composition of your products (i.e., their SBOMs, or software bills of material) and diligently managing the security of your software supply chain.

It is vital that we all pay attention to, and fully appreciate the implications of, the Atlantic Council's recent Breaking trust: Shades of crisis across an insecure software supply chain analysis.⁵  The report opens with a simple statement: “Software supply chain security remains an under-appreciated domain of national security policymaking.” It is also underappreciated by manufacturers and users of medical devices, I would venture to state.

Regardless of the industry or branch of government, we all are highly dependent on the software supply chain. “Society has a software problem,” and unfortunately, cybercriminals and state actors have recognized that as an opportunity. Compromising commercial or open-source software and injecting themselves into the delivery process enables attackers to select their target industry and fly under the radar of our defenses as they launch an attack via a trusted source or channel.

Supply chain attacks are effective and difficult to detect, and they can cause great financial or even physical harm. Among notable examples are the infection of security software CCleaner in 2017⁶  (with several million downloads of the infected version) and the compromise of the MEDoc accounting software used by Ukrainian companies, resulting in the distribution of the NotPetya Wiper malware (also in 2017).⁷  Malware distributed via the software supply chain can have significant and harmful consequences to both the receiving and distributing parties and can lead to legal, financial, and reputational damage.

The risk is even higher with embedded systems. The software supply chain can be complex and difficult to monitor, compromised software can be difficult to detect on the target system, and the impact can be significant. There have been reports of medical devices being shipped out of the factory with computer viruses already on them, and MDM download sites have been hijacked to distribute malware.⁸ 

Certainly, as medical device systems become more complex and distributed, including use in patients' homes and data services provided via cloud-based infrastructure, this problem will only increase. This is a dangerous combination of devices that are difficult to maintain and update, have limited security detection and protection capabilities, and are now combined with services provided by public networks and hosted services.

The Atlantic Council report, which analyzed 115 software supply chain attacks from the previous 10 years, concluded that “software supply chain attacks provide huge value for attackers and remain popular. These attacks are impactful, giving attackers access to critical infrastructure like electrical power generation and nuclear enrichment systems. States like Russia, China, North Korea, and Iran attack the software supply chain as part of their offensive cybersecurity efforts.”⁵ 

The following is a summary of the key trends identified by the Atlantic Council report⁵ :

• Deep impact from state actors: There were at least 27 different state attacks against the software supply chain, including from Russia, China, North Korea, and Iran, as well as from India, Egypt, the United States, and Vietnam.

• Abusing trust in code signing: These attacks undermine public key cryptography and certificates used to ensure the integrity of code.

• Hijacking software updates: 27% of these attacks targeted software updates to insert malicious code against sometimes millions of targets.

• Poisoning open-source code: These incidents saw attackers either modify open-source code by gaining account access or post their own packages with names similar to commonly used names.

• Targeting app stores: 22% of these attacks targeted app stores like the Google Play Store, Apple's App Store, and other third-party app hubs to spread malware to mobile devices. Some attacks even targeted developer tools—meaning every app later built using that tool was potentially compromised.

The following is a summary of the report's three main recommendations to policymakers and industry⁵ :

1. Improve the baseline. The lynchpin of any effort to improve the security of software supply chains broadly will be what affects the largest number of codebases—not what improves one codebase the most.

2. Better protect open source. Open-source software is a critical part of most enterprise systems and networks. The security of open-source projects, and the apparent ease with which attackers can introduce insecure code, is a significant issue.

3. Counter systemic threats. Trust is the critical coin of the realm in software supply chains, and the United States must work with allies to protect against deliberate efforts to undermine software supply chains.

The report specifically calls out the following characteristics of software supply chain attacks⁵ :

• They exploit natural seams between organizations and abuse relationships where users expect to find trustworthy code.

• Attacks are impactful and can drive compromise deep into anorganization's technology stack, undermining development and administrative tools, code-signing, and device firmware.

• These attacks have strategic utility for state actors and have been used to great effect.

From a cybersecurity perspective, a supply chain attack is the archetype of an APT (advanced persistent threat)⁹  as it allows an attacker to target and infiltrate specific industries or even organizations, penetrate their network, and remain undetected while conducting their objective—be it information gathering or sabotage. We need to recognize that supply chain attacks are a real and complex threat that can affect MDMs and HDOs alike. Traditional security management processes and technologies typically fall short of (1) ensuring security and reliability of the software supply chain and (2) detecting supply chain compromises and preventing them from doing harm.

Therefore, as organizations implement and develop security-inclusive life cycle management processes,¹⁰  including cybersecurity as part of their supplier management is essential. Ensuring that the supplier uses secure development and design processes and actively manages the security posture of their products, including in production and distribution, is critical. Accomplishing this requires a combination of process, technology, and assurance.

Plenty of examples, including those cited in this article, underline the risks and criticality of our software supply chain. Unfortunately, as always in cybersecurity, things are likely to get worse before they get better—so we best heed the warnings sooner rather than later.