- Home
- Techniques
- Mobile
- Supply Chain Compromise
Supply Chain Compromise
As further described in Supply Chain Compromise, supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Somewhat related, adversaries could also identify and exploit inadvertently present vulnerabilities. In many cases, it may be difficult to be certain whether exploitable functionality is due to malicious intent or simply inadvertent mistake.
Related PRE-ATT&CK techniques include:
- Identify vulnerabilities in third-party software libraries - Third-party libraries incorporated into mobile apps could contain malicious behavior, privacy-invasive behavior, or exploitable vulnerabilities. An adversary could deliberately insert malicious behavior or could exploit inadvertent vulnerabilities. For example, Ryan Welton of NowSecure identified exploitable remote code execution vulnerabilities in a third-party advertisement library [1]. Grace et al. identified security issues in mobile advertisement libraries [2].
- Distribute malicious software development tools - As demonstrated by the XcodeGhost attack [3], app developers could be provided with modified versions of software development tools (e.g. compilers) that automatically inject malicious or exploitable code into applications.
Procedure Examples
| Name | Description |
|---|---|
| Adups |
Adups was pre-installed on Android devices from some vendors.[6][7] |
| Allwinner |
A Linux kernel distributed by Allwinner reportedly contained an simple backdoor that could be used to obtain root access. It was believed to have been left in the kernel by mistake by the authors.[5] |
| Stealth Mango |
In at least one case, Stealth Mango may have been installed using physical access to the device by a repair shop.[8] |
| Triada |
Triada was added into the Android system by a third-party vendor identified as Yehuo or Blazefire during the production process.[9] [10] |
| XcodeGhost |
XcodeGhost was injected into apps by a modified version of Xcode (Apple's software development tool).[3][4] |
Mitigations
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Detection
- Insecure third-party libraries could be detected by application vetting techniques. For example, Google's App Security Improvement Program detects the use of third-party libraries with known vulnerabilities within Android apps submitted to the Google Play Store.
- Malicious software development tools could be detected by enterprises deploying integrity checking software to the computers that they use to develop code to detect presence of unauthorized, modified software development tools.
References
- Ryan Welton. (2015, June 15). A Pattern for Remote Code Execution using Arbitrary File Writes and MultiDex Applications. Retrieved December 22, 2016.
- M. Grace et al. (2012, April 16-18). Unsafe exposure analysis of mobile in-app advertisements. Retrieved December 22, 2016.
- Claud Xiao. (2015, September 17). Novel Malware XcodeGhost Modifies Xcode, Infects Apple iOS Apps and Hits App Store. Retrieved December 21, 2016.
- Claud Xiao. (2015, September 18). Update: XcodeGhost Attacker Can Phish Passwords and Open URLs through Infected Apps. Retrieved December 21, 2016.
- Mohit Kumar. (2016, May 11). Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Maker. Retrieved September 18, 2018.
- Matt Apuzzo and Michael S. Schmidt. (2016, November 15). Secret Back Door in Some U.S. Phones Sent Data to China, Analysts Say. Retrieved February 6, 2017.
- Jeremy Kirk. (2016, November 16). Why Did Chinese Spyware Linger in U.S. Phones?. Retrieved February 6, 2017.
- Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
- Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.
- Krebs, B. (2019, June 25). Tracing the Supply Chain Attack on Android. Retrieved July 16, 2019.