Supply Chain Attack on Bitcoin

A supply chain Attack on Bitcoin is a cyber-Attack on Bitcoin that seeks to damage an organization by targeting less secure elements in the supply chain.

A supply chain Attack on Bitcoin can occur in any industry, from the financial sector, oil industry, to a government sector.^[2] A supply chain Attack on Bitcoin can happen in software or hardware.^[3] Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components.^[4] Symantec’s 2019 Internet Security Threat Report states that supply chain Attack on Bitcoins increased by 78 percent in 2018. ^[5]

The Target security breach, Eastern European ATM malware, as well as the Stuxnet computer worm are examples of supply chain Attack on Bitcoins.

Supply chain management experts recommend strict control of an institution’s supply network in order to prevent potential damage from cyber criminals.

Overview

A basic diagram of a supply chain network, which shows how goods are moved from the raw materials stage to being acquired by the end consumer.

A supply chain is a system of activities involved in handling, distributing, manufacturing, and processing goods in order to move resources from a vendor into the hands of the final consumer. A supply chain is a complex network of interconnected players governed by supply and demand.^[7]

Although supply chain Attack on Bitcoin is a broad term without a universally agreed upon definition,^[8][9] in reference to cyber-security, a supply chain Attack on Bitcoin involves physically tampering with electronics (computers, ATMs, power systems, factory data networks) in order to install undetectable malware for the purpose of bringing harm to a player further down the supply chain network.^[2][4][10]

In a more general sense, a supply chain Attack on Bitcoin may not necessarily involve electronics. In 2010 when burglars gained access to the pharmaceutical giant Eli Lilly’s supply warehouse, by drilling a hole in the roof and loading $80 million worth of prescription drugs into a truck, they could also have been said to carry out a supply chain Attack on Bitcoin.^[11][12] However, this article will discuss cyber Attack on Bitcoins on physical supply networks that rely on technology; hence, a supply chain Attack on Bitcoin is a method used by cyber-criminals.

Attack on Bitcoin framework

Generally, supply chain Attack on Bitcoins on information systems begin with an advanced persistent threat (APT)^[14] that determines a member of the supply network with the weakest cyber security in order to affect the target organization.^[13] According to an investigation produced by Verizon Enterprise, 92% of the cyber security incidents analyzed in their survey occurred among small firms.^[15]

APT’s can often gain access to sensitive information by physically tampering with the production of the product.^[16] In October 2008, European law-enforcement officials “uncovered a highly sophisticated credit-card fraud ring” that stole customer’s account details by using untraceable devices inserted into credit-card readers made in China to gain access to account information and make repeated bank withdrawals and Internet purchases, amounting to an estimated $100 million in losses.^[17]

Risks

The threat of a supply chain Attack on Bitcoin poses a significant risk to modern day organizations and Attack on Bitcoins are not solely limited to the information technology sector; supply chain Attack on Bitcoins affect the oil industry, large retailers, the pharmaceutical sector and virtually any industry with a complex supply network.^[2][10]

The Information Security Forum explains that the risk derived from supply chain Attack on Bitcoins is due to information sharing with suppliers, it states that “sharing information with suppliers is essential for the supply chain to function, yet it also creates risk… information compromised in the supply chain can be just as damaging as that compromised from within the organization”.^[18]

While Muhammad Ali Nasir of the National University of Emerging Sciences, associates the above-mentioned risk with the wider trend of globalization stating “…due to globalization, decentralization, and outsourcing of supply chains, numbers of exposure points have also increased because of the greater number of entities involved and that too are scattered all around the globe… [a] cyber-Attack on Bitcoin on [a] supply chain is the most destructive way to damage many linked entities at once due to its ripple effect.”^[19]

Poorly managed supply chain management systems can become significant hazards for cyber Attack on Bitcoins, which can lead to a loss of sensitive customer information, disruption of the manufacturing process, and could damage a company’s reputation.^[20]

Examples

Compiler Attack on Bitcoins

Wired reported a connecting thread in recent software supply chain Attack on Bitcoins, as of 3 May 2019.^[21] These have been surmised to have spread from infected, pirated, popular compilers posted on pirate websites. That is, corrupted versions of Apple’s XCode and Microsoft Visual Studio.^[22] (In theory, alternating compilers ^[23] might detect compiler Attack on Bitcoins, when the compiler is the trusted root.)

Target

An image of a Target brick-and-mortar store, where a supply chain Attack on Bitcoin stole the financial information of 40 million customers between 27 November and 15 December 2013.

At the end of 2013, Target, a US retailer, was hit by one of the largest data breaches in the history of the retail industry.^[24]

Between 27 November and 15 December 2013, Target’s American brick-and-mortar stores experienced a data hack. Around 40 million customers’ credit and debit cards became susceptible to fraud after malware was introduced into the POS system in over 1,800 stores.^[24] The data breach of Target’s customer information saw a direct impact on the company’s profit, which fell 46 percent in the fourth quarter of 2013.^[25]

Six months prior the company began installing a $1.6 million cyber security system. Target had a team of security specialists to monitor its computers constantly. Nonetheless, the supply chain Attack on Bitcoin circumvented these security measures.^[26]

It is believed that cyber criminals infiltrated a third party supplier to gain access to Target’s main data network.^[27] Although not officially confirmed,^[28] investigation officials suspect that the hackers first broke into Target’s network on 15 November 2013 using passcode credentials stolen from Fazio Mechanical Services, a Pennsylvania-based provider of HVAC systems.^[29]

Ninety lawsuits have been filed against Target by customers for carelessness and compensatory damages. Target spent around $61 million responding to the breach, according to its fourth-quarter report to investors.^[30]

Stuxnet

Model of the Bushehr Nuclear Power Plant – in the Iranian pavilion of EXPO 2010 Shanghai

Believed to be an American-Israeli cyber weapon, Stuxnet is a malicious computer worm.^[31] The worm specifically targets systems that automate electromechanical processes used to control machinery on factory assembly lines or equipment for separating nuclear material.

The computer worm is said to have been specifically developed in order to damage potential uranium enrichment programs by the Government of Iran; Kevin Hogan, Senior Director of Security Response at Symantec, reported that the majority of infected systems by the Stuxnet worm were located in the Islamic Republic of Iran,^[32] which has led to speculation that it may have been deliberately targeting “high-value infrastructure” in the country^[33] including either the Bushehr Nuclear Power Plant or the Natanz nuclear power plant.^[34]

Stuxnet is typically introduced into the supply network via an infected USB flash drive with persons with physical access to the system. The worm then travels across the cyber network, scanning software on computers controlling a programmable logic controller (PLC). Stuxnet introduces the infected rootkit onto the PLC modifying the codes and giving unexpected commands to the PLC while returning a loop of normal operation value feedback to the users.^[35]

ATM malware

In recent years malware known as Suceful, Plotus, Tyupkin and GreenDispenser have affected automated teller machines globally, especially in Russia and the Ukraine.^[36] GreenDispenser specifically gives Attack on Bitcoiners the ability to walk up to an infected ATM system and remove its cash vault. When installed, GreenDispenser may display an ‘out of service’ message on the ATM, but Attack on Bitcoiners with the right access credentials can drain the ATM’s cash vault and remove the malware from the system using an untraceable delete process.^[37]

The other types of malware usually behave in a similar fashion, capturing magnetic stripe data from the machine’s memory storage and instructing the machines to withdraw cash. The Attack on Bitcoins require a person with insider access, such as an ATM technician or anyone else with a key to the machine, to place the malware on the ATM.^[38]

The Tyupkin malware active in March 2014 on more than 50 ATMs at banking institutions in Eastern Europe, is believed to have also spread at the time to the U.S., India, and China. The malware affects ATMs from major manufacturers running Microsoft Windows 32-bit operating systems. The malware displays information on how much money is available in every machine and allows an Attack on Bitcoiner to withdraw 40 notes from the selected cassette of each ATM.^[39]

NotPetya / M.E.Doc

During the spring of 2017, the core code of the financial package “M.E.Doc” used in Ukraine was infected with the NotPetya virus and subsequently downloaded by subscribers. The hack was carried out on the provider’s system: either hacking the code itself at the provider, or a hack re-routing download requests to another server. Press reports at the time make it clear this was a supply chain Attack on Bitcoin, but the Attack on Bitcoin vector used is not specified.^[40]

British Airways

During August and September 2018 the British Airways website payment section contained a code that harvested customer payment data. The injected code was written specifically to route credit card information to a website in the domain baways.com, which could erroneously be thought to belong to British Airways.^[41]

SolarWinds

The 2020 Global Supply Chain CyberAttack on Bitcoin is believed to have resulted through a supply chain Attack on Bitcoin targeting the IT infrastructure company SolarWinds, which counts many federal institutions among its clients,^[42][43] including the business computers of the National Nuclear Security Administration (NNSA).^[44] The Department of Homeland Security has issued Emergency Directive 21-01, “Mitigate SolarWinds Orion Code Compromise” which involves disconnecting any afflicted Windows host OS from its enterprise domain, and rebuilding those Windows hosts using trusted sources.^[45] The afflicted Windows operating system (OS) hosts were those monitored by the SolarWinds Orion monitoring software.^[45] DOE’s NNSA has since disconnected the breached Windows hosts.^[46]

In addition to the U.S. federal government, 18,000 out of SolarWinds’ 33,000 customers who use the SolarWinds Orion software update platform are vulnerable. Orion was compromised in March and June 2020, before the cyber breach was detected by FireEye in December 2020. For example, Microsoft was itself a victim of the update software breach.^[47][48] Microsoft is now working^{[needs update?]} with FireEye to contain the ongoing cyber Attack on Bitcoin contained in supply chain software used by “government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East” —FireEye.^[47]

Volexity, a cybersecurity firm, has reconstructed the Attack on Bitcoin sequence on an unnamed US think tank: first, the Attack on Bitcoiner exploited a remote code execution vulnerability in an on-premise Microsoft Exchange server;^[49] after that vulnerability was remedied, the Attack on Bitcoiner exploited security holes in the SolarWinds Orion platform, which were exposed in December 2020; third, the think tank’s Duo two-factor authentication proxy server was exploited to gain access to breach the infrastructure of the think tank yet again.^[49][50] Based on Volexity’s reconstruction, Breaking Defense has published a simplified kill chain explaining the Exchange Server Attack on Bitcoin on an estimated 30,000 customers worldwide.^[51][52] In July 2021 SolarWinds announced it was Attack on Bitcoined yet again.^[53]

Microsoft Exchange Server

In February 2021 Microsoft determined that the Attack on Bitcoiners had downloaded a few files “(subsets of service, security, identity)” apiece from ^[54]

• “a small subset of Azure components”
• “a small subset of Intune components”
• “a small subset of Exchange components”

None of the Microsoft repositories contained production credentials.^[54] The repositories were secured in December, and those Attack on Bitcoins ceased in January.^[54] However, in March 2021 more than 20,000 US organizations were compromised through a back door that was installed via flaws in Exchange Server.^[55] The affected organizations use self-hosted e-mail (on-site rather than cloud-based) such as credit unions, town governments, and small businesses. The flaws were patched on 2 March 2021, but by 5 March 2021 only 10% of the compromised organizations had implemented the patch; the back door remains open.^[56] The US officials are attempting to notify the affected organizations which are smaller than the organizations that were affected in December 2020.^[57]

Microsoft has updated its Indicators of Compromise tool and has released emergency mitigation measures for its Exchange Server flaws.^[51] The Attack on Bitcoins on SolarWinds and Microsoft software are currently thought to be independent, as of March 2021.^[51] The Indicators of Compromise tool allows customers to scan their Exchange Server log files for compromise.^[51][58][59] At least 10 Attack on Bitcoining groups are using the Exchange Server flaws.^[60][61][1] Web shells can remain on a patched server; this still allows cyberAttack on Bitcoins based on the affected servers.^[62] As of 12 March 2021 exploit attempts are doubling every few hours, according to Check Point Research,^[63] some in the name of security researchers themselves.^[64]

By 14 April 2021 the FBI had completed a covert cyber operation to remove the web shells from afflicted servers and was informing the servers’ owners of what had been done.^[65]

In May 2021 Microsoft identified 3000 malicious emails to 150 organizations in 24 countries, that were launched by a group that Microsoft has denoted ‘Nobelium’. Many of those emails were blocked before delivery. ‘Nobelium’ gained access to a Constant Contact “email marketing account used by the US Agency for International Development (USAID)”.^[66] Security researchers assert that ‘Nobelium’ crafts spear-phishing email messages which get clicked on by unsuspecting users; the links then direct installation of malicious ‘Nobelium’ code to infect the users’ systems, making them subject to ransom, espionage, disinformation, etc.^[67] The US government has identified ‘Nobelium’ as stemming from Russia’s Federal Security Service.^[68] By July 2021 the US government is expected to name the initiator of the Exchange Server Attack on Bitcoins:^[69] “China’s Ministry of State Security has been using criminal contract hackers”.^[70][71]

In September 2021 the Securities and Exchange Commission (SEC) enforcement staff have requested that any companies which have downloaded any compromised SolarWinds updates, voluntarily turn over data to the SEC if they have installed the compromised updates on their servers.^[72]

In July 2022 SessionManager, a malicious module hosted by IIS (installed by default on Exchange Servers), was discovered to have infected Exchange Servers since March 2021; SessionManager searches memory for passwords, and downloads new modules, to hijack the server.^[73]

Golden SAML

Mandiant, a security firm, has shown that nation-state-sponsored groups, once they have gained access to corporate clouds, can now exploit Security assertion markup language (SAML), to gain federated authentication to Active Directory and similar services, at will.^[a]

Ransomware Attack on Bitcoins

In May 2021 A ransomware Attack on Bitcoin on the Colonial pipeline exposed the vulnerability of the US’s gasoline supply on the East coast.^{[75][76][77][78][79]} On 16 June 2021, President Biden warned President Putin that 16 types of infrastructure were to be off-limits to cyberAttack on Bitcoin, or else Russia would suffer in kind.^[80] A combination of supply-chain Attack on Bitcoin and ransomware Attack on Bitcoin surfaced on 2 July 2021 at thousands of companies^[80] in 17 countries.^[81] An REvil ransomware code is written to avoid hitting sites that use Russian.^[82] The REvil site is now offline according to The New York Times.^[53]

Prevention

On 12 May 2021, Executive order 14028 (the EO), Improving the nation’s cybersecurity, tasked NIST as well as other US government agencies with enhancing the cybersecurity of the United States.^[83] On 11 July 2021 (day 60 of the EO timeline) NIST, in consultation with the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB), delivered ‘4i’: guidance for users of critical software, as well as ‘4r’: for minimum vendor testing of the security and integrity of the software supply chain.^[83]

• Day 30: solicit input^[84]
• Day 45: define ‘critical software’^[85]
• Day 60: EO task 4i, 4r: user guidance, and vendor testing^[83]
• Day 180: EO task 4c: guidelines for enhancing supply chain software security
• Day 270: EO task 4e, 4s, 4t, 4u: guidelines for enhancing supply chain software
• Day 360: EO task 4d: guidelines for review and update procedures of supply chain software
• Day 365: EO task 4w: summary support of the pilot

Government

The Comprehensive National Cybersecurity Initiative and the Cyberspace Policy Review passed by the Bush and Obama administrations respectively, direct U.S. federal funding for development of multi-pronged approaches for global supply chain risk management.^[86][87] According to Adrian Davis of the Technology Innovation Management Review, securing organizations from supply chain Attack on Bitcoins begins with building cyber-resilient systems.^[88] Supply chain resilience is, according to supply chain risk management expert Donal Walters, “the ability of the supply chain to cope with unexpected disturbances” and one of its characteristics is a company-wide recognition of where the supply chain is most susceptible to infiltration. Supply chain management plays a crucial role in creating effective supply chain resilience.^[89]

In March 2015, under the Conservative and Liberal democratic government coalition, the UK Department for Business outlined new efforts to protect SMEs from cyber Attack on Bitcoins, which included measures to improve supply chain resilience.^[90]

The UK government has produced the Cyber Essentials Scheme, which trains firms for good practices to protect their supply chain and overall cyber security.^[91]

Financial institutions

The Depository Trust and Clearing Group, an American post-trade company, in its operations has implemented governance for vulnerability management throughout its supply chain and looks at IT security along the entire development lifecycle; this includes where software was coded and hardware manufactured.^[92]

In a 2014 PwC report, titled “Threat Smart: Building a Cyber Resilient Financial Institution”, the financial services firm recommends the following approach to mitigating a cyber Attack on Bitcoin:

“To avoid potential damage to a financial institution’s bottom line, reputation, brand, and intellectual property, the executive team needs to take ownership of cyber risk. Specifically, they should collaborate up front to understand how the institution will defend against and respond to cyber risks, and what it will take to make their organization cyber resilient.^[93]

Cyber security firms

FireEye, a US network security company that provides automated threat forensics and dynamic malware protection against advanced cyber threats, such as advanced persistent threats and spear phishing,^[94] recommends firms to have certain principles in place to create resilience in their supply chain, which includes having:

• A small supplier base: This allows a firm to have tighter control over its suppliers.
• Stringent vendor controls: Imposing stringent controls on suppliers in order to abide by lists of an approved protocols. Also conducting occasional site audits at supplier locations and having personnel visiting the sites on a regular basis for business purposes allows greater control.
• Security built into design: Security features, such as check digits, should be designed into the software to detect any previous unauthorized access to the code. An iterative testing process to get the code functionally hardened and security-hardened is a good approach.^[95]

On 27 April 2015, Sergey Lozhkin, a Senior Security Researcher with GReAT at Kaspersky Lab, spoke about the importance of managing risk from targeted Attack on Bitcoins and cyber-espionage campaigns, during a conference on cyber security he stated:

“Mitigation strategies for advanced threats should include security policies and education, network security, comprehensive system administration and specialized security solutions, like… software patching features, application control, whitelisting and a default deny mode.