What Is a Supply Chain Attack?

Supply chain attacks in technology focus on software vendors and hardware manufacturers. Attackers search for unsafe code, unsafe infrastructure practices, and unsafe network procedures that allow the injection of malicious components. When a build process requires several steps from development (or manufacturing) to installation, an attacker (or group of attackers) has several opportunities to inject their own malicious code into the final product.

Some manufacturers, vendors, and developers build products used by thousands of clients. An attacker who can breach one of these suppliers could potentially gain access to thousands of unsuspecting victims, including technology companies, governments, security contractors, and more. Instead of breaching just one targeted organization, a supply chain attack gives an attacker the potential to obtain access to numerous large and small businesses to silently exfiltrate extensive amounts of data without their knowledge.

In a hardware supply chain attack, a manufacturer can install a malicious microchip on a circuit board used to build servers and other network components. Using this chip, the attacker can eavesdrop on data or obtain remote access to the corporate infrastructure. In a software-level supply chain attack, a malicious library developer can change code to perform malicious actions within their client’s application. The library could be used for cryptojacking, stealing data, or leaving a backdoor for an attacker to remotely access a corporate system.

In many of the biggest supply chain threats, email fraud is the primary vector used to begin the attack. Business email compromise (BEC) works well for attackers that do their due diligence and research into their target. That is because they can send email messages to key employees (e.g., finance) to instruct them to pay an invoice or send money. The sender’s address looks like that of the CEO or owner, and it’s written in a way that sounds urgent to the recipient. In some scenarios, the attacker compromises an email account for an executive and uses it to send phishing emails to employees within the organization.

Any vendor that relies on third parties to build a product is vulnerable to supply chain attacks. In general attacks, threat actors focus on any target, not a specific business. However, in sophisticated attacks, threat actors focus on government agencies or large organizations worth billions. In state-sponsored attacks, a threat actor focuses on governments and their infrastructure. These attacks could cost lives if the malware crashes critical systems.

Security vendors are perfect targets. Organizations trust security vendors to protect their data and reputation. With stealthily placed malicious code in security contractor infrastructure and controls, an attacker can silently siphon data from large corporation systems and send it to an attacker-controlled network. Data vulnerable to these attacks could be financial, personally identifiable information (PII), patient information, and employee data.

A Managed Service Provider (MSP) is another primary target. These businesses support organizational infrastructure and have systems in place to monitor activity. Having access to an MSP system would give an attacker access to numerous MSP client systems. With the right malicious code, the attacker could access MSP credentials, giving attackers access to client infrastructure. Another option for the attacker would be to skim credit card numbers from payment dashboards and customer support systems.

Open source is a great way for developers to collaborate with other developers to improve their code. When other developers contribute to the codebase, the code should be reviewed for any security flaws. These flaws could be mistakenly added to the codebase or purposely added. Because most open-source projects are publicly available to other developers, a mistaken security bug in code could be caught by an attacker before a helpful third party. The attacker could then write code to exploit the security vulnerability leaving all corporations that use the open-source code open to targeted exploits.

Any organization with a hierarchy of employees posted on social media or on the organization’s website is a target for BEC. An attacker can collect a list of high-privilege accounts for phishing, social engineering, or tricking employees into paying fraudulent invoices. After reconnaissance, an attacker can “become” the person they intend to use to trick employees into sending money or pay the invoices. In some scenarios, vendors for the organization could also be at risk. An attacker might compromise a vendor’s email account and use it to email targeted high-privilege employees within the victim organization.

Because supply chain attacks target developers and manufacturers outside of your organization’s control, they are difficult to stop. You should always review any code or hardware before installing it on your infrastructure. Security professionals will also perform a penetration test on these components to ensure that they do not have any unforeseen vulnerabilities maliciously injected into your system or exploitable ones accidentally introduced into the system.

Although supply chain attacks are outside your control, you can still follow several strategies to avoid becoming a victim. Here are a few strategies:

Proofpoint staff are experts in supply chain attacks and the many ways threats pose a risk to your data privacy, compliance, and your cybersecurity defenses. We offer extensive services that protect a primary attack vector – email. We protect the supply chain for several industries, including healthcare, financial services, education, manufacturing, and more.