Hello and welcome to
another application of the minor
tech framework discussion today
we're going to be looking at supply
chain compromise.
So let's go ahead and jump right
in.
So what objectives are we trying
to meet through this discussion
today? Well, we want you to walk
away with an understanding
of what a supply chain compromise
is and how that looks.
And we've got some examples
that we'll go through.
So we'll touch on both of those and
help you to understand what that
looks like.
We're going to look at some mitigation
techniques and then we're going to
look at what are some detection
techniques as well within this
particular area.
So let's go ahead and jump right in.
So Supply-Chain compromise
is the manipulation of a product
or products delivery mechanism
prior to consumer
receipt.
So something has been
tampered with or changed
without the knowledge of the vendor,
and it is delivered as trusted
to the consumer.
This can include hardware
manipulation.
So we've heard of chips
and things of that nature being
manipulated or having malware put
on them or having
malicious pre installed
malware put on things like cameras
and smart TVs.
We've seen things of that nature
where the camera turns on and does
things like records, information
and then some malicious apps
using the identity of a trusted
company, silver certificate
or something of that nature that
they use to sign an application is
compromised.
The threat actor can make changes
and then sign it as that trusted
entity.
So some examples of this
that we had seen in the last few
years were KSE cleaner, which
was compromised by hackers for over
a month.
The tool was impacted by malware
that gave the attackers a back door,
essentially to use their systems
over to point to seven million
downloads occurred in this period.
That's pretty big.
And then another example, mobile
games such as Infestation and point
blank were identified by Kaspersky
and Essent as having back toward
versions of the games being
distributed.
So any time you're
on the Android market or the
Apple market or the play stores or
whatever the case may be, it's
important to take the time to,
you know, look at the app,
understand whether or not it may be
a candidate for
malicious use.
And most of the times I don't trust
anything that comes off the play
store as far as free apps and things
of that nature. I know there was
recently a
face app that I downloaded
to to look at because it was popular
and found out the very next day that
it was being used
by a foreign entity to collect
personal information and things of
that nature. So I was very
disappointed in myself.
Now, before we go any further,
this particular Klingner compromise
was from a few years ago, but
a vast recently released
the following article back
in October, which I think is
relevant to share.
So it looks like there
was a breach and hackers
were targeting KSE cleaner
again. Now, there was
a lot of transparency on a vast part
in kind of pulling everything
together and sharing
with us what exactly
happened. And so the attack
seems to have been sophisticated,
which typically would supply
chain attacks and things of that
nature. It would be.
And the attacker was attempting to
leave no traces
of their intrusion, which would be
important when trying to compromise
the supply chain or something of
that nature.
And so they were alerted
through an advanced threat
analytics platform provided by
Microsoft on the 25th of September.
And they made some
observations and found that there
were seven additional attempts that
were made starting in May
of twenty nineteen.
So this is important because if
they didn't have some of these
controls in place where they were
able to monitor this activity or get
these alerts,
would this attack or have been
successful in getting into the
system? And it's likely that that
would be the case.
And so they left a temporary VPN
profile open so that they can
monitor the activity.
And they found that the user of the
profile did not have domain admin
privilege.
However, they were able to go
through and do some privileged
escalation. So we're seeing several
things happening here, right?
There was a temporary VPN
account that was left open.
The attacker was able to get in.
They had an account that was not
privileged but were able to
successfully obtain domain
administrative privilege.
So they didn't get into further
detail there. But we see the
initial access happening right
through a service that
is publicly facing or remote
access service that's publicly
available.
And then we see lateral movement
through.
That account so did
not note any further implications
of the breach, other than that it
started
on the twenty fifth.
Now,
the other indicator here that
we had or that was discussed was
that
they did not have
dual factor authentication set up on
the account, which could have
bolstered, you know, the ability
of the attacker to maybe not get in
or to kind of mitigate their
abilities there.
But they ultimately validated
that cleaner, didn't have any
any compromise or any issues at
this point.
So they continue to
monitor that threat actors activity
and they're continuing to work
through that.
But this is just one example
of an attempt to compromise
the supply chain.
And in this case, it was already
previously compromised.
And so this is definitely
a target that the user may
want or that they may want there.
So when we think
about that, remember, Supply-Chain
compromise isn't just about
compromising the software outright.
There are factors and things that
have to happen in that initial
access phase. And then we saw a
privileged escalation in what not.
Those are things we'll talk about
later as well.
But just because supply chain is in
the initial access area doesn't mean
that that is the end for the threat
actor. They still have to move
through several areas of
the attack framework to follow
through on that.
All right, everybody.
Well, we're going to go ahead and
take a quick intermission.
The next part of our discussion will
be coming up.
Please stay tuned.