Cyber hackers targeting software supply chains, says report
Cyber hackers are "clearly targeting software supply chains" to achieve a range of potential effects to include cyber espionage, organisational disruption, or demonstrable financial impact.
That's the verdict of the 2018 Foreign Economic Espionage in Cyberspace report, which said last year represented a watershed in the reporting of software supply chain operations.
In 2017, seven significant events were reported in the public domain compared to only four between 2014 and 2016. As the number of events grows, so too are the potential impacts.
Large-scale events in 2017 included the following:
• Floxif infected 2.2 million worldwide CCleaner customers with a backdoor. The hackers specifically targeted 18 companies and infected 40 computers to conduct espionage to gain access to Samsung, Sony, Asus, Intel, VMWare, O2, Singtel, Gauselmann, Dyn, Chunghwa and Fujitsu.
• Hackers corrupted software distributed by the South Korea-based firm Netsarang, which sells enterprise and network management tools. The backdoor enabled downloading of further malware or theft of information from hundreds of companies in energy, financial services, manufacturing, pharmaceuticals, telecommunications, and transportation industries.
• A tweaked version of M.E. Doc was infected with a backdoor to permit the delivery of software from the Ukrainian accounting firm a destructive payload
disguised as ransomware. This attack, which was attributed to Russia, paralyzed networks worldwide, shutting down or affecting operations of banks, companies, transportation, and utilities. The cost of this attack to FedEx and Maersk was approximately $300 million each.
• A malware operation dubbed Kingslayer, targeted system administrator accounts associated with U.S. firms to steal credentials in order to breach the system and replace the legitimate application and updates with a malware version containing an embedded backdoor. Although it is not known which and how many firms were ultimately infected, at least one U.S. defence contractor was targeted and compromised.
The report said foreign intelligence services from China, Russia and Iran are the leading sources of cyberthreats targeting economic espionage, and that emerging technologies such as artificial intelligence and the Internet of Things will introduce new attack threats for which U.S. networks are not prepared.