Software Supply Chains Demand a New Web of Trust

Thoughts about digital transformation and AI for enterprise leaders and their legal & compliance advisors

These posts represent my personal views on enterprise governance, regulatory compliance, and legal or ethical issues that arise in digital transformation projects powered by the cloud and artificial intelligence. Unless otherwise indicated, they do not represent the official views of Microsoft.

Once upon a time a software application was a simple thing with few dependencies. You installed it on a computer and it did its work. Every few years you bought an updated version with some new features and installed that in place of the old version. The process wasn’t completely risk free (what is?) but the risks were small and well understood. As long as the software provider didn’t plant malicious code in the application or allow a bandit to put malware on the installation disk, you were safe. You needed to trust the provider not to do those things, but this was a routine kind of trust, not much different than the trust you have that your dentist is not trying to kill you.

In the online era of course everything is different. Software no longer comes neatly packaged on disks, but arrives as a stream of bits over the Internet. What’s more, installing an application is no longer a one-time affair. Today apps are constantly being updated from multiple remote servers that might be located on a distant continent and may be operated by multiple third parties the user has never heard of.

Such a world is full of new dangers. Legal and compliance teams may not be familiar with the term “software supply chain.” But now is the time to learn, because the cybersecurity of every enterprise depends on the security of its software supply chain. Software has so totally permeated the fabric of business and society that it can wreak havoc when it turns bad. Being able to sue the software’s provider or invoke liability laws is no longer an adequate insurance policy against bad actors who can commandeer an innocent provider’s software from remote Internet lairs hidden from view.

And indeed, scarcely a week goes by without some new outbreak of software banditry on the global Internet. For an enterprise to navigate these seas without being victimized requires the establishment of a new and much stronger web of trust encompassing the entire software supply chain.

So what exactly is the software supply chain and how can it be made more trustworthy in a world full of cyber attackers? It turns out Microsoft has been tracking supply chain threat actors for years. But my thoughts on this subject were provoked by reading the latest edition of Microsoft’s frequently updated Security Intelligence Report. The just-published volume 24 of this series, which has a chapter on the topic full of data and examples covering the year 2018, provides the following definition:

“In a supply chain attack, the attacker concentrates on compromising the development or update process of a legitimate software publisher. If successful, the attacker can incorporate a compromised component into a legitimate application or update package that then gets distributed to the software’s users. The malicious code then runs with the same trust and permissions as the software.”

Here are some examples of how software supply chain attacks work:

• A software vendor’s infrastructure for creating and updating its apps is corrupted by an attacker and used to inject malware into the systems of unsuspecting users
• The online identity of a legitimate software company is usurped by means of stolen code-sign certificates or signed malicious apps
• Malicious code is planted by an outsider into hardware or firmware components of a legitimate supplier
• Malware is pre-installed on devices (cameras, USB keys, phones, etc.)

It’s worth tracing an actual example of an attack to see how the process unfolds and what can be done to stop it. The short answer is that it takes powerful machine learning algorithms (aka artificial intelligence) cooperating in real-time across the cloud and local end-user devices such as PCs and smartphones. The attack in this particular case was defeated by a combination of Microsoft’s endpoint device-based and cloud-based cybersecurity software. But the attackers’ basic approach would have been the same regardless of which providers’ tools (if any) were available to defend against it.

The first large-scale software supply chain attack detected by Microsoft’s security teams in 2018 occurred on March 6. In the space of a few minutes, tens of thousands of customer PCs in several countries running Microsoft’s Windows Defender Antivirus software suddenly began reporting to our cloud-based security servers that a Trojan known as Dofoil was attempting to install itself. Within the first 12 hours we detected more than 400,000 global instances of Dofoil attacks, 73% in Russia, 18% in Turkey, and 4% in Ukraine.

Dofoil is a malicious software utility hackers use to deliver additional malware packages that accomplish their primary mission—usually financial misdeeds of some kind, theft of sensitive data, or espionage. In this case, as our analysts soon discovered, Dofoil was intended to install a “coin miner,” which is a piece of software that steals CPU cycles on your computer to create or “mine” new cryptocurrency coins that are then cashed in by the hackers.

Dofoil was detected on the victimized endpoint devices by machine learning algorithms built into Windows Defender Antivirus. These algorithms constantly monitor the software environment on the device where they are installed. When they spot suspicious behavior, they report it back immediately to our cloud servers. Within milliseconds of the first reports, additional machine learning algorithms on our cloud servers identified the suspect software as a malicious Trojan and ordered it to be blocked.

After the smoke cleared from the initial attack wave, our cloud security team used the history tracking feature in Windows Defender Advanced Threat Protection (known affectionately as WDATP) to understand how the attackers had prepared their attack. WDATP is a remarkable tool that comes built into the enterprise edition of Windows 10. Among its other capabilities, it records a rolling history of possible software anomalies on an organization’s endpoint devices and stores them in our cloud in a secure enclave dedicated to that organization.

Using these WDATP records, our analysts determined that the March 6 attack actually began in mid-February, when the attackers initially corrupted a popular peer-to-peer media sharing app called MediaGet. This is a BitTorrent client often used to download apps or video from websites with dubious reputations. As you probably already knew, such apps carry a certain risk of downloading malware hidden inside a file selected by the user. It’s not our business to tell customers what they can or cannot do, so our antivirus software doesn’t automatically block these apps. But we do classify them as “potentially unwanted applications,” which means that WDATP knows to watch them closely for signs of anomalous activity.

In this particular case, however, the MediaGet file-sharer did not download the Dofoil malware from BitTorrent. Rather, the hackers infiltrated a legitimate third-party software update tool used by MediaGet to update its own app. They then commandeered the update tool to install a malicious copy of MediaGet. The doctored copy behaved just like the original, but included additional instructions that the hackers would later activate to install—or attempt to install—the Dofoil malware.

This elaborate multi-step scheme shows just how cunning and sophisticated software supply chain attacks have become. In an era when every computer and smartphone is assumed to be connected 24/7 to the Internet, even the most trivial software applications use online updating to receive bug fixes, urgent security patches, and new features. This means that virtually every app on your laptop and your phone has a complicated global supply chain through which new bits are constantly and silently delivered to your device via pathways that are entirely opaque to you.

These software supply chains are indispensable to the proper functioning of modern software. In particular, they deliver crucial fixes for newly identified security flaws. It would be unthinkable to do away with software updating. But the tools used to perform the updating are themselves vulnerable to attackers and require extra fortification. In the March 2018 incident recounted above, Microsoft’s analysts believe that the third-party supplier of MediaGet’s update tool was itself an innocent victim. The hackers somehow obtained credentials for that supplier’s internal network and managed to sneak in and corrupt the code or the servers used by the update tool.

Software supply chain attacks are on the rise. The latest Microsoft Security Intelligence Report documents a shift in 2018 in the type of malware payload most commonly delivered in these attacks. Where ransomware led the pack in 2017, greater awareness of and improved defenses against ransomware caused hackers in 2018 to shift to coin miners as their preferred monetization scheme.

Learning enough about your software supply chains to have confidence that they are safe is a huge challenge. In fact, even for a large enterprise, it’s almost impossible unless you have help from a partner you trust.

As a practical matter, it is virtually impossible to prevent such attacks. You must assume that your organization will be attacked—and likely is already being attacked—by software supply chain threat actors.

Fortunately, however, it is not impossible to defend against these attacks. Indeed, a properly configured cyber defense can shut them down within milliseconds, before they have time to do harm. The MediaGet example shows us that an effective defense must be multi-layered. It’s crucial that smart software on endpoint devices can communicate instantly with smart software in the cloud. Both sides must deploy advanced machine learning algorithms that are themselves continually updated with new information about newly observed attacks and those who perpetrate them.

It’s also crucial that the cloud-side machine learning tools be backed by teams of human experts on call 24/7 to respond to incidents in real-time and make decisions that AI by itself is not qualified to make.

Last but not least, it’s indispensable for this multi-layered team of AI and human defenders to be fed with a vast global stream of real-time data flowing in from hundreds of millions of devices. Data by itself is not intelligent, but it is the foundation of all intelligent action. In the MediaGet Dofoil incident, it was the ability of the Microsoft security team to recognize almost instantly—literally within milliseconds—that a large coordinated attack was under way and urgent action was needed to shut it down. Only massive amounts of global data can provide such visibility and permit such swift response.

Orchestrating all the pieces needed to mount a complete cyber defense of your software supply chains is a job that very few cloud or software providers in the world are equipped to perform. At Microsoft we see our job as marshaling every scrap of data, every intelligent software tool, and every ounce of human expertise we posses to defend our customers from cyber attackers. We can’t guarantee a 100% success rate. But as Microsoft CEO Satya Nadella put it recently, securing the world’s software supply chains is not just about Microsoft, but about us working together with our partners and our customers to secure the shared software ecosystem that sustains our shared global economy.

Today’s cyber threats are more sophisticated than ever before

Microsoft has published a book about how to manage the thorny cybersecurity, privacy, and regulatory compliance issues that can arise in cloud-based Digital Transformation—including a section on 360-degree security. The book explains key topics in clear language and is full of actionable advice for enterprise leaders. Click here to download a copy. Kindle version available as well here.