Supply Chain Compromise: Compromise Software Supply Chain

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.[1] [2]

Angreifer können Anwendungssoftware manipulieren, bevor sie beim Endverbraucher ankommt, um Daten oder Systeme zu kompromittieren. Die Kompromittierung von Software in der Lieferkette kann auf verschiedene Weise erfolgen, z. B. durch Manipulation des Quellcodes der Anwendung, durch Manipulation des Update-/Verteilungsmechanismus für diese Software oder durch Ersetzen kompilierter Versionen durch eine modifizierte Version.

Das Targeting kann spezifisch auf eine gewünschte Opfergruppe ausgerichtet sein oder an eine breite Gruppe von Verbrauchern verteilt werden, aber nur bei bestimmten Opfern zu weiteren Taktiken übergehen.(Zitat: Avast CCleaner3 2018) (Zitat: Command Five SK 2011)

Les adversaires peuvent manipuler les logiciels d'application avant leur réception par un consommateur final dans le but de compromettre les données ou le système. La compromission de la chaîne d'approvisionnement d'un logiciel peut se faire de plusieurs façons, notamment par la manipulation du code source de l'application, la manipulation du mécanisme de mise à jour/distribution de ce logiciel, ou le remplacement des versions compilées par une version modifiée.

Le ciblage peut être spécifique à un ensemble de victimes souhaitées ou peut être distribué à un large ensemble de consommateurs mais ne passer à des tactiques supplémentaires que sur des victimes spécifiques.(Citation : Avast CCleaner3 2018) (Citation : Command Five SK 2011)

Gli avversari possono manipolare il software applicativo prima di riceverlo da un consumatore finale allo scopo di compromettere i dati o il sistema. La compromissione della catena di approvvigionamento del software può avvenire in vari modi, tra cui la manipolazione del codice sorgente dell'applicazione, la manipolazione del meccanismo di aggiornamento/distribuzione di quel software o la sostituzione di versioni compilate con una versione modificata.

Il targeting può essere specifico per un set di vittime desiderato o può essere distribuito a un ampio set di consumatori ma passare solo a tattiche aggiuntive su vittime specifiche.(Citazione: Avast CCleaner3 2018) (Citazione: Command Five SK 2011)

Login
ID: T1195.002
Sub-technique of:  T1195
Tactic: Initial Access
Platforms: Linux, Windows, macOS
Version: 1.0
Created: 11 March 2020
Last Modified: 11 March 2020
Translations:  DE FR IT EN
Provided by LAYER 8

Procedure Examples

ID Name Description
G0016 APT29

APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.[3][4]

G0096 APT41

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.[5]

S0222 CCBkdr

CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.[6][7][1]

G0080 Cobalt Group

Cobalt Group has compromised legitimate web browser updates to deliver a backdoor. [8]

G0035 Dragonfly

Dragonfly has placed trojanized installers on legitimate vendor app stores.[9]

G0115 GOLD SOUTHFIELD

GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.[10][11][12]

S0493 GoldenSpy

GoldenSpy has been packaged with a legitimate tax preparation software.[13]

G0034 Sandworm Team

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.[14][15][16]

S0562 SUNSPOT

SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.[17]

Mitigations

ID Mitigation Description
M1051 Update Software

A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation.

M1016 Vulnerability Scanning

Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.[18]

Detection

Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

Verwenden Sie die Überprüfung von verteilten Binärdateien durch Hash-Prüfung oder andere Mechanismen zur Integritätsprüfung. Scannen Sie Downloads auf bösartige Signaturen und versuchen Sie, Software und Updates vor der Bereitstellung zu testen, während Sie auf potenziell verdächtige Aktivitäten achten.

Utilisez la vérification des binaires distribués par le biais de la vérification du hachage ou d'autres mécanismes de vérification de l'intégrité. Analysez les téléchargements pour détecter les signatures malveillantes et essayez de tester les logiciels et les mises à jour avant leur déploiement tout en prenant note des activités suspectes potentielles.

Utilizzare la verifica dei binari distribuiti attraverso il controllo dell'hash o altri meccanismi di controllo dell'integrità. Esamini i download alla ricerca di firme dannose e cerchi di testare il software e gli aggiornamenti prima dello spiegamento, prendendo nota di potenziali attività sospette.

References