Supply-Chain Attacks: Why the U.S. Should Worry

Glenn Greenwald released a photograph from the Snowden documents in May 2014 showing the National Security Agency covertly installing an implant in a Cisco router intercepted during shipping. Reporting later indicated that the larger document in which this photo appeared concerned a router destined for Syria; according to the document, it ended up providing NSA with “unique access” to Syrian internet and telephone systems. But whatever intelligence benefits the router provided, this single photo caused incalculable damage to U.S. technology companies, prompting the rest of the world to think twice about purchasing from U.S. sources.

This was a “supply chain” attack, one in which the saboteur—in this case the U.S. government—tampered with electronics before delivery. While Greenwald noted the comparison between U.S. supply-chain attacks and those conducted by China, many others commenting on the controversy at the time neglected this reciprocity. Any foreign government with the capability to do something the NSA does will do so—and most will do so with far less restraint. This is why the U.S. government must keep Chinese and Russian hardware and software—whether Kaspersky antivirus, Huawei routers or ZTE phones—out of government or other critical systems.

There are different types of supply-chain attacks: generic attacks, which attempt to sabotage all devices; and targeted attacks, which take advantage of knowing the end customer for a device. Additionally, supply-chain attacks on the software component can take place not only when a device is shipped but also whenever the software receives an update. There are also information-gathering supply-chain attacks in which a cloud service provider reveals data.

Supply-chain attacks have taken place both with and without the supplier's awareness or consent. For example, the Juniper backdoor saga involved the technology company Juniper Networks deploying a random number generator known as Dual_EC in its VPN software. This algorithm includes a built-in sabotage option, which enables anyone knowing the secret to decrypt VPN traffic. Presumably, this initial source-code change was done with Juniper’s consent (or at least the consent of a Juniper employee). Later, somebody else snuck in a change, rekeying this backdoor so that, instead, a new third party could decrypt the VPN traffic. We presume that this second supply-chain attack happened without Juniper’s knowledge.

The U.S. government needs to take supply-chain attacks much more seriously and refine government purchasing in ways that resist these attacks. Some attacks—such as bulk sabotage of consumer chips or devices—are probably unavoidable. But wide-ranging attacks like these can cause only limited amounts of damage, because, unless they are particularly subtle, they are more likely to be detected.

There is a much greater danger from telecommunications equipment, computer software or cloud services provided by Chinese or Russian companies where the ultimate customer is known to the manufacturer. After all, a sabotaged computer could act as a foothold wherever it is installed, and a sabotaged router can both collect traffic of interest and launch attacks on network traffic passing through the router—which is particularly concerning if the customer is the U.S. government.

Software produced by Kaspersky Labs is among the usual suspects here—and, indeed, the government is far along in efforts to remove it from official systems. ZTE phones and routers have also been in the news. As of now, it looks like the Senate’s version of the National Defense Authorization Act will include a prohibition on U.S. government purchase of ZTE and Huawei telecommunications equipment. One hopes this prohibition will be preserved in Conference.

Of particular concern to me is Lenovo, the Chinese technology giant. The danger here lies not in where Lenovo’s computers are produced—that is, within China—but from the question of who can sign the computers’ drivers, which the manufacturer enables to run. Drivers effectively run in “god mode” on the computer and can be updated in the field, enabling a sabotaged driver to access anything on the computer. So sabotaging a driver is a very powerful attack. What if the manufacturer’s government attempts to coerce the manufacturer in a way similar to how the FBI attempted to coerce Apple?

Additionally, it is generally straightforward to sabotage a computer with physical access. This is particularly easy when the manufacturer knows the end customer: There is a huge logistical difference between sabotaging all laptops and sabotaging just those shipped to a U.S. government buyer. These companies may want to be 100 percent honest, but that doesn’t eliminate the danger of foreign-government pressure being used to sabotage U.S. infrastructure or to spy on government communications.

It should not be a matter of political debate to see the dangers posed by Chinese or Russian products in U.S. networks. Trade groups have generally resisted the notion of restrictions on various companies, but it is critical to assess the stakes honestly: If the U.S. government has practiced supply-chain attacks, others are likely to do the same to the U.S. if and when they can. For this reason, it is vital for national security that the ban on those government purchases remain in the NDAA.