Why Hardware, Firmware and Software Supply Chains Put Critical Infrastructure at Risk

A supply chain covers everything involved in making a product and getting it to the buyer. Gail Ow, Senior Industrial Solutions Manager at Keysight Technologies, suggests it can decide whether a company and its products succeed, since better supply chain management produces better results for consumer and producer alike in cost, quality, delivery, safety, customer satisfaction and revenue.

Firmware: the part attackers want

In a global economy the idea is easy to follow. Ow uses her own laptop as an example: its components come from factories all over the world, and that applies to every part, not only the obvious ones such as the metal casing and the key caps. Tampering with hardware at some stage of manufacture does happen. Attackers, however, are not interested in key caps. What they go after is the firmware controlling devices such as webcams, trackpads, hard drives and network interface cards, all of which have been shown to be hackable.

Firmware is the software that is, in effect, "etched" onto hardware and makes a device work. That etching is less permanent than it once was, Ow notes. Firmware lives on flash ROMs that can be wiped, loaded with malware and rewritten. From the attacker's point of view, a firmware compromise is hard to spot and awkward to fix, often requiring the device to go back to the manufacturer. She likens it to near-godlike power that comes with invisibility. A successful attacker gets direct access to every device the manufacturer produces, sells and ships, not merely a single unit, and the owners have no idea they have been compromised.

If firmware can be hacked, Ow asks, how exposed are all the free apps people enjoy? And in industrial control systems and operational technology (ICS/OT), how well managed is the software supply chain behind a plant's PLCs, HMIs and SCADA systems?

The software supply chain, from fonts to SolarWinds

In her time as a Product Manager, Ow worked with engineering teams to build products that addressed real customer problems, and she appreciates why the hardware and firmware supply chain has to be tightly controlled. The software side did not occur to her until she watched her son, then at college, download clever new font modules onto his computer. Programmers everywhere rely heavily on shared libraries and modules, which means software has a supply chain too. The idea was fairly new, she says, until NOBELIUM, the Russia-based hacking group best known for the SolarWinds cyberattack of December 2020.

NOBELIUM has gone after more than 150 organisations worldwide, among them government agencies, think tanks, consultants and non-governmental organisations in at least 25 countries. The attack on Colonial Pipeline then pushed software supply chain hacks into the spotlight. It put the pipeline out of action for more than a week and affected 45% of the fuel supply on the U.S. East Coast, causing panic buying and higher prices. The operator shut down all its systems to contain the ransomware, fuel shortages lasted for weeks, and the company eventually paid a US$4.4 million ransom to regain control of its network and data.

The U.S. response on critical infrastructure

Following the continuing attacks on U.S. critical infrastructure, President Biden signed the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems (NSM) on July 28, 2021. It contained few details, though more were promised. On August 25th, the U.S. National Institute of Standards and Technology (NIST) announced that it would lead the creation of a new framework to improve the security and integrity of the technology supply chain.

That announcement centres on the technology supply chain as it relates to critical infrastructure. Equipment that once worked physically, through pneumatics or electro-mechanical systems, has become digital and connected to the internet, and so, Ow remarks drily, open to hacking. That makes securing the supply chain a top priority.

Attackers have noticed that factories and critical infrastructure are now online. Ow describes them as having grown comfortable in their new role as the gods of ICS/OT, trying relentlessly to break into every such system, with critical infrastructure the most attractive target. Beyond extorting money from victims who never saw it coming, they can now poison communities, halt oil production, cause explosions, grab headlines and wreck the economic health of whole countries, all while collecting millions of dollars in ransom. Breaking into ICS/OT environments lets attackers build their own weapons of mass destruction, she warns, especially when the victim belongs to one of the 16 critical infrastructure sectors.

Bills of materials as the near-term answer

For reducing risk in the near term, Ow points to bills of materials for hardware, software and firmware. They show what is inside a product so that it can be checked: whether the manufacturer supplied exactly what was expected, and whether that is what is actually installed. Knowing the contents lets an organisation decide where a component belongs in its architecture, how isolated it must be, how to manage it and how to handle incident response. Because the threat to the technology supply chain is ongoing, she argues that nobody is exempt, and manufacturers, critical infrastructure operators and consumers all have an active part to play in making the world safer.