On Dec. 13 last year, cybersecurity company FireEye broke news of the most widespread hacking attack on US government agencies in the country’s history. Government departments affected by the attack, which exploited a vulnerability in proprietary network management software made by the Texas-based software provider SolarWinds, included the US departments of energy, treasury, homeland security, justice and defense.
The SolarWinds incident highlights the severe impact that “software supply chain” attacks can have. Hackers first analyze the software used by the target organization, then identify downstream suppliers to these software products with relatively weak data security practices and infect their software update infrastructure with malicious code. Once the organization updates the software, the malicious code is downloaded onto its systems.
Taiwan is no stranger to software supply chain hacking attacks. From June to November 2018, a software update server operated by Asustek Computer fell victim to a hacker who used a hidden malicious code to infect a new version of software distributed to tens of thousands of Asus laptops, even though the software update carried a valid digital signature.
After receiving information from the Criminal Investigation Bureau, the National Communications Commission on Jan. 6 ordered Taiwan Mobile to recall all 94,000 units of its self-branded, China-made Amazing A32 smartphones after their built-in software was found to contain a malicious program.
An investigation by the bureau found that a malicious program had been embedded into the smartphones’ firmware memory prior to leaving the factory. This means that even if a user restarts or resets their phone, the malicious program would not be removed.
After issuing a recall, Taiwan Mobile carried out an audit of all of its Amazing brand smartphones, and established that only the Amazing A32 is subcontracted to a Chinese manufacturer and the other models do not have the same data security flaw.
Analyses of past instances of software supply chain hacking attacks show that they can basically be classified into four types of attacks.
The first is where the supplier company is itself the attacker.
For example, a bad actor could spend US$100 million to purchase a software company that has tens of thousands of enterprise clients, then use the company’s software product(s) to deliver Trojan horse malicious code. This is a much cheaper and more effective way to infect machines than going to the trouble of developing an online attack that has to infect each target organization one by one.
The second is to hack the software supply company and bury malicious code within its software. This is how the SolarWinds attack was carried out.
The third is when a software supplier uses third-party software in their product that contains malicious code, such as open source software.
The fourth involves a software supplier using third-party software that contains flawed code that can be exploited by hackers. Since contemporary software design makes use of a large number of open source software packages, malicious actors have a relatively large number of opportunities to embed malicious code within frequently used software programs.
The Clean Network program, proposed by the US Department of State in April last year, asks participating telecoms not to use electronic equipment that contains China-made software, such as Huawei Technologies products. This type of policy is designed to pre-empt and prevent the first category of supply chain attack.
In addition to strengthening its own data security protections, Taiwan Semiconductor Manufacturing Co is asking its suppliers to establish basic data security standards, and incorporate these into their routine inspections and audits.
The idea is that if each manufacturer within the industrial ecosystem establishes appropriate data security self-defense, this should help to prevent the second class of supply chain attack.
To resist the third and fourth types of attack requires the manufacturer of each piece of software-containing equipment and device to establish a software bill of materials (SBOM). An SBOM should clearly list all of the open source software packages used within its software, known flaws within each of the packages, the main developer of the software, and the company or organization to which they are affiliated.
Since many of Taiwan’s computer and network communications equipment firms will be expected to provide an SBOM in the future, establishing a database of open source software that conforms to traceability requirements and can continuously track software updates, which can be shared by manufacturers, would greatly reduce the cost of compiling SBOMs for Taiwan’s domestic industries.
Additionally, to more effectively deal with the last two types of supply chain attacks, it would be necessary to develop software analysis tools that can scan the source code of open source software and identify potential malicious software and other vulnerabilities. Unfortunately, such tools are not yet fully mature, and require further research and development.
Chiueh Tzi-cker is general director of Information and Communication Labs at the Industrial Technology Research Institute.
Translated by Edward Jones
Xiaomi Corp founder Lei Jun (雷軍) on May 22 made a high-profile announcement, giving online viewers a sneak peek at the company’s first 3-nanometer mobile processor — the Xring O1 chip — and saying it is a breakthrough in China’s chip design history. Although Xiaomi might be capable of designing chips, it lacks the ability to manufacture them. No matter how beautifully planned the blueprints are, if they cannot be mass-produced, they are nothing more than drawings on paper. The truth is that China’s chipmaking efforts are still heavily reliant on the free world — particularly on Taiwan Semiconductor Manufacturing
Keelung Mayor George Hsieh (謝國樑) of the Chinese Nationalist Party (KMT) on Tuesday last week apologized over allegations that the former director of the city’s Civil Affairs Department had illegally accessed citizens’ data to assist the KMT in its campaign to recall Democratic Progressive Party (DPP) councilors. Given the public discontent with opposition lawmakers’ disruptive behavior in the legislature, passage of unconstitutional legislation and slashing of the central government’s budget, civic groups have launched a massive campaign to recall KMT lawmakers. The KMT has tried to fight back by initiating campaigns to recall DPP lawmakers, but the petition documents they
A recent scandal involving a high-school student from a private school in Taichung has reignited long-standing frustrations with Taiwan’s increasingly complex and high-pressure university admissions system. The student, who had successfully gained admission to several prestigious medical schools, shared their learning portfolio on social media — only for Internet sleuths to quickly uncover a falsified claim of receiving a “Best Debater” award. The fallout was swift and unforgiving. National Yang Ming Chiao Tung University and Taipei Medical University revoked the student’s admission on Wednesday. One day later, Chung Shan Medical University also announced it would cancel the student’s admission. China Medical
Construction of the Ma-anshan Nuclear Power Plant in Pingtung County’s Hengchun Township (恆春) started in 1978. It began commercial operations in 1984. Since then, it has experienced several accidents, radiation pollution and fires. It was finally decommissioned on May 17 after the operating license of its No. 2 reactor expired. However, a proposed referendum to be held on Aug. 23 on restarting the reactor is potentially bringing back those risks. Four reasons are listed for holding the referendum: First, the difficulty of meeting greenhouse gas reduction targets and the inefficiency of new energy sources such as photovoltaic and wind power. Second,
RSS