Supply Chain Attack.

What is a supply chain attack?

A supply chain attack is an attack that reaches a target by going through the products or services it depends on. The NIST glossary, quoting CNSSI 4009-2022, defines it as an incident where an adversary exploits vulnerabilities in the product or service supply network of the intended target. An adversary is the person or group carrying out the attack.

What does the supply network include?

The NIST glossary notes that a supply network can be internal, such as logistics, or external, such as third-party providers. A third-party provider is an outside company that supplies a product or service to the target. This means the weak point may sit outside the organization that is finally affected.

How does a supply chain attack work?

MITRE ATT&CK lists this as technique T1195, named Supply Chain Compromise. MITRE says adversaries manipulate products or delivery mechanisms before the consumer receives them, in order to compromise data or systems. MITRE says this can happen at various stages of the supply chain. It points to places such as development tools, source code repositories, software updates, system images and the replacement of legitimate software.

MITRE splits the technique into three sub-techniques. T1195.001 is Compromise Software Dependencies and Development Tools. T1195.002 is Compromise Software Supply Chain. T1195.003 is Compromise Hardware Supply Chain. A dependency is a piece of outside software that a product relies on. Recent npm cases include the Keyv npm maintainer account takeover and the Nx Console extension and GitHub repositories breach.

What is the software supply chain?

The software supply chain is the set of steps and parts that go into building and delivering software, which includes code, tools and updates. CISA and NIST have published guidance called Defending Against Software Supply Chain Attacks. It gives an overview of software supply chain risks and recommendations for software customers and vendors.

What can an attack achieve?

The NIST glossary says attacks may occur at any point in a system lifecycle. Their aims can be to exfiltrate or manipulate data, disrupt operations, or enable future access. Exfiltrate means to copy data out of a network without permission. ENISA studied supply chain attacks from January 2020 to early July 2021. It says half of the attacks were attributed to Advanced Persistence Threat (APT) actors, whose complexity and resources greatly exceed those of more common non-targeted attacks. ENISA concludes that there is an increasing need for new protective methods that incorporate suppliers.

How can you detect or reduce the risk?

MITRE’s detection guidance covers software that arrives from atypical sources or with signature or hash mismatches. It also covers installers that write binaries to unexpected paths, and first runs that load unsigned or abnormally signed modules or start unexpected child processes.

MITRE lists these mitigations. Developers should lock software dependencies to specific versions rather than pulling the latest version on build. Organizations can limit software installation by pulling from internal repositories with verified packages rather than external sources. They can restrict software permissions to reduce how far a compromise can propagate. MITRE also lists vulnerability scanning, described as continuous monitoring and the use of automatic and manual code review tools.

CISA and NIST say their guidance covers prevention, mitigation and resilience for software supply chain attacks. It points to the NIST Cyber Supply Chain Risk Management framework and the Secure Software Development Framework.

Is a supply chain attack the same as a software supply chain attack?

Not exactly. A supply chain attack is the wider idea and covers any product or service network. A software supply chain attack is the case where the manipulated part is software, its tools or its updates.

Related terms are third-party risk and patch management.