Supply Chain - Revision history

Tom: /* Full Title or Meme */

2023-09-16T01:10:04Z

‎Full Title or Meme

Tom: /* Full Title or Meme */

2023-09-16T01:09:07Z

‎Full Title or Meme

Tom: /* Trust */

2023-08-06T22:57:11Z

‎Trust

Tom: /* Trust */

2023-08-06T22:47:19Z

‎Trust

Tom: /* Open Source Code */

2023-06-28T04:32:45Z

‎Open Source Code

Tom: /* DevSecOps */

2023-06-28T04:14:46Z

‎DevSecOps

Tom: /* Signed Code */

2023-06-28T01:36:52Z

‎Signed Code

Tom: /* Problems */

2023-06-28T00:30:25Z

‎Problems

Tom: /* Trust */

2022-09-22T22:54:46Z

‎Trust

Tom: /* Trust */

2022-09-22T22:54:00Z

‎Trust

@@ Line 2: / Line 2: @@
 For [[Identity Management]] in a digital world the important parts of the supply change are the user hardware and software and the entire cloud ecosystem.
-The Supply Chain was used originally to apply the material supply or logistics. The name has been repurposed here for the software supply chain.
+The Supply Chain was used originally to apply to material supply or logistics. The name has been repurposed here for the software supply chain.
 ==Context==

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
 For [[Identity Management]] in a digital world the important parts of the supply change are the user hardware and software and the entire cloud ecosystem.
 ==Context==

@@ Line 102: / Line 102: @@
 * [https://developers.google.com/android/binary_transparency Binary Transparency] [https://binary.transparency.dev/ Building Trust in the Software Supply Chain]
 * [https://certificate.transparency.dev/ Certificate Transparency] Working together to detect maliciously or mistakenly issued certificates.
 ==References==

@@ Line 102: / Line 102: @@
 * [https://developers.google.com/android/binary_transparency Binary Transparency] [https://binary.transparency.dev/ Building Trust in the Software Supply Chain]
 * [https://certificate.transparency.dev/ Certificate Transparency] Working together to detect maliciously or mistakenly issued certificates.
 ==References==

@@ Line 38: / Line 38: @@
 ===Open Source Code===
-Perhaps the largest threat to the software supply chain is the large and growing collection of utilities that are available that run on the commonly deployed operating systems with admin privilege. While the large vulnerability created by Solar Winds was proprietary code, there was at least a corporate entity to take responsibility. With a large number of open source utilities, there is no such entity to take responsibility when attacks occur. One such utility was the Apache Log4j, a Java-based logging utility originally released on 2001-01-08 by an individual. It is part of the Apache Logging Services, a project of the Apache Software Foundation. Other loggers are available, but Apache's large footprint makes this logger widespread.
+Perhaps the largest threat to the software supply chain is the large and growing collection of utilities that are available that run on the commonly deployed operating systems with admin privilege. While the large vulnerability created by SolarWinds was proprietary code, there was at least a corporate entity to take responsibility. With a large number of open source utilities, there is no such entity to take responsibility when attacks occur. One such utility was the Apache Log4j, a Java-based logging utility originally released on 2001-01-08 by an individual. It is part of the Apache Logging Services, a project of the Apache Software Foundation. Other loggers are available, but Apache's large footprint makes this logger widespread.
 A major exploit was discovered by Chen Zhaojun of Alibaba Cloud Security Team as reported by Wired "A vulnerability in the Log4j logging framework has security teams scrambling to put in a fix."<ref>Lilly Hey Newman, The Internet Is on Fire’'' Wired (2021-12-18) https://www.wired.com/story/log4j-flaw-hacking-internet/</ref> On 2021-11-26 Cisco entered [https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228 CVE-2021-44228]. A patch release came on on 2021-12-06 from Apache. On 2021-12-11 the US DHS CISA released a warning that suggested users take immediate action to patch vulnerabilities.<ref>STATEMENT FROM CISA DIRECTOR EASTERLY ON “LOG4J” VULNERABILITY'' (2021-12-11) US DHS CISA https://www.cisa.gov/news/2021/12/11/statement-cisa-director-easterly-log4j-vulnerability</ref> By then exploits were already proliferating across the globe. Apache's web site explains that Log4j version 1 is still supported and no warning that '''all''' old releases should be immediately killed. That is really bad advice from Apache.

@@ Line 86: / Line 86: @@
 The code development paradigm gives developers the ability to create deployment packages which contain code that the developer pulled in as a dependency, often with little more than a click to download the code from a repository. The result is that some other attack on some other code body can bet included into an application package without review. A new paradigm of DevSecOps adds an additional layer that assures the code building process is not compromised.
 ===DevSecOps===
-Is basically just DevOps with an intervening security check. Assuming that the developers were not able to build the final product, that would have been sufficient to block the Solar Winds attack.
+Is basically just DevOps with an intervening security check. Assuming that the developers were not able to build the final product, that would have been sufficient to block the SolarWinds attack.
 ===Risk Management===

@@ Line 33: / Line 33: @@
 ==Signed Code==
-When a company signs an application package, the concept is that the application is safe to run. As we have seen with the Solar Winds it is possible for an attacker to replace a piece of third-party code with one that contains malware. They the signed package seems to have all of the right dependencies, but those dependencies were compromised before the application was built and signed. This situation is common with devops development paradigms.
+When a company signs an application package, the concept is that the application is safe to run. As we have seen with the SolarWinds it is possible for an attacker to replace a piece of third-party code with one that contains malware. They the signed package seems to have all of the right dependencies, but those dependencies were compromised before the application was built and signed. This situation is common with devops development paradigms.
 In the case of the https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/ NVIDIA hack], the signing key itself was either exfiltrated, or the attacker was able to sign their own code which enables then to install code into the kernel of Microsoft Windows.
@@ Line 41: / Line 41: @@
 A major exploit was discovered by Chen Zhaojun of Alibaba Cloud Security Team as reported by Wired "A vulnerability in the Log4j logging framework has security teams scrambling to put in a fix."<ref>Lilly Hey Newman, The Internet Is on Fire’'' Wired (2021-12-18) https://www.wired.com/story/log4j-flaw-hacking-internet/</ref> On 2021-11-26 Cisco entered [https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228 CVE-2021-44228]. A patch release came on on 2021-12-06 from Apache. On 2021-12-11 the US DHS CISA released a warning that suggested users take immediate action to patch vulnerabilities.<ref>STATEMENT FROM CISA DIRECTOR EASTERLY ON “LOG4J” VULNERABILITY'' (2021-12-11) US DHS CISA https://www.cisa.gov/news/2021/12/11/statement-cisa-director-easterly-log4j-vulnerability</ref> By then exploits were already proliferating across the globe. Apache's web site explains that Log4j version 1 is still supported and no warning that '''all''' old releases should be immediately killed. That is really bad advice from Apache.
 ==Attacks==
 -08-14 was really bad for software supply chain. A massive attack against GitHub covertly inserted malicious code into potentially thousands of software repositories. Meanwhile a separate supply chain attack apparently against the iOS and Android Solana crypto wallets has siphoned millions of dollars of cryptocurrency. While #SBOM is a really important tool for software supply chain, it doesn't address issues like this which have been a huge anxiety for things like sensitive federal programs or segments of our economy depending on open-source projects. - Charles Clancy Senior Vice President, MITRE

@@ Line 15: / Line 15: @@
 * Even though it may be incredibly difficult to get management to consider supply chain issues, it is not useful to address any security issues if you cannot even be sure that the computers and the software delivered are free of deliberate or accidental vulnerabilities.
 * Portable hardware devices have proven to be an easy attack target. In the simplest case a USB file key is left lying around where someone might use it and thus infect the computer. In more sophisticated attacks the hardware will be altered in the supply chain before it reaches the intended target user. For example ''Criminals are mailing altered Ledger devices to steal cryptocurrency'' <ref>Lawrence Abrams, ''Criminals are mailing altered Ledger devices to steal cryptocurrency'' Bleeping Computer (2021-06-16) https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency/</ref>
-* The exploits have started to surface with (2020) Solar Winds infections that continue to be discovered. There the problem was a dll that was replaced in the development chain that was never validated.
+* The exploits have started to surface with (2020) SolarWinds infections that continue to be discovered. There the problem was a dll that was replaced in the development chain that was never validated.
 * Developer tools make it very easy to inject dependence's on external packages with just a click of the mouse. [https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 the article on "Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies"] shows how easy that act can be exploited. The vulnerability has always been their, but as other exploits are blocked, this one becomes more attractive.
 * Another tool attack that appeared in 2015 in Travis CI was still the source of leaked developers [[Credential]]s in 2022.<ref>Dan Goodin, ''Credentials for thousands of open-source projects free for the taking—again!'' (2022-06-13) Ars Technica https://arstechnica.com/information-technology/2022/06/credentials-for-thousands-of-open-source-projects-free-for-the-taking-again/</ref> This is a case of a tool that enables continuous integration of updates into running code. So that any code that uses these tools can have one of the dependencies compromised, which infects the delivered end product.

@@ Line 99: / Line 99: @@
 ===Trust===
-* Binary Transparency [https://binary.transparency.dev/ Building Trust in the Software Supply Chain]
+* [https://developers.google.com/android/binary_transparency Binary Transparency] [https://binary.transparency.dev/ Building Trust in the Software Supply Chain]
 * [https://certificate.transparency.dev/ Certificate Transparency] Working together to detect maliciously or mistakenly issued certificates.