Hyperledger Foundation Hyperledger Global Forum 2021, 11 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: The Poisoned Well, Supply Chain Security, Open Source and Hyperledger - Vipin Bharathan, dlt.nyc

Description

The Poisoned Well, Supply Chain Security, Open Source and Hyperledger - Vipin Bharathan, dlt.nyc

A software supply chain attack happens when a malicious party modifies any part of a software development stack to compromise a target down the chain. Any user of the target can be breached using the modifications in order to attack the system directly or to deliver a malicious payload. The recently well-publicized Solar winds hack has brought this vulnerability into focus. A vulnerability that has gained in potency and reach due to widespread use of COTS and COSS software. This talk starts by covering the history of such attacks as well as the types and the lead actors in the attacks. Open source software is crucial in the software ecosystem. The openness of FOSS is leveraged by supply chain attackers. The talk is aimed at raising awareness of supply chain vulnerability in open source development. Some mitigation measures are discussed, including applicability to Hyperledger.

Sessions Details & Slides (if available)- https://sched.co/j3cb

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2021 #Blockchain

A

So I'm going to go through the presentation, even though I do not have a way to share it. um So basically I'm going to talk about the software supply chain.

A

uh The agenda is uh going to be software supply chain, the attack surface of the uh sub software supply chain, uh uh commercial, open, uh commercial, off-the-shelf uh software, as well as commercial of the shelf. uh uh You know software shared uh open source software. Okay, uh then the.

A

Trends in open uh in uh software supply chain compromises, evaluation of data on actual attacks and the solar winds hack, which is obviously the hack that brought everybody the attention to the software supply chain and the special case of open source software and some mitigation measures, especially for.

A

Especially for hyperledger, okay- that's that's the so first thing is software is ubiquitous, which obviously means that it is highly pervasive it's everywhere and it is on 24 7. and obviously software is evolving fast and it's highly complex. These are all very simple statements, but they have a implications.

A

So the what are the consequences? The consequences are because of the high pace of evolution of software. Most enterprises do not develop uh in-house software; they get commercial off-the-shelf software or commercial open source software.

A

They also. It is also based on the principle of reuse and outsourcing complexity.

A

The world's appetite for software is ever increasing.

A

Somebody said that software is eating the world, but I think it is more that the world is eating software and having it as a greater part of its diet, and because of this.

A

The world has many cases of indigestion and poisoning and major major organs can be affected. These are all metaphors, but in the end the metaphors make sense. When uh the the abstraction of the metaphor and the actual use actual observed uh problems in the world coincide now in terms of the software supply chain attacks, there was a well-known thought: experiment from ken thompson in 1984.

A

He was speaking as a touring award honoree and it was a turing award lecture and he talked about how a c compiler can be hacked to insert a trojan horse, leaving no traces in the source. Essentially, the source is modified to allow certain passwords.

A

uh You know which are not in the list of uh approved passwords to.

A

The source is hacked, make the changes made. The c compiler itself is written in c, so it is compiled and then the source is put back to its original.

A

uh You know without the hack, and so the no traces of this hack are found in the source. No static analysis, no dynamic analysis, I mean no analysis of the source. Would let you know that the compiler has been altered as the level of the program gets lower. This is what ken thompson said. Ken thompson, of course, is the duo of ken thompson and ritchie, who created the unix uh operating system and also the c compiler, and as the level of the program gets lower, these bugs will be harder and harder to detect a well-installed.

A

Microcode bug will be almost impossible to detect. So it's already known that in 1984 that you can do this, you can actually uh hack the supply chain. The actual uh you know, software that builds the other software and insert a bug into uh the compiled program.

A

um Also made another point, which is that you have to trust the writers of the program rather than trusting um anybody else. So so, and he made another point which was the crime of breaking into a computer should be as bad as a crime of breaking into somebody else's house or stealing a car or something like that. But obviously people can do this frictionlessly from afar and they do not face the same consequences.

A

Now we go to the solar winds, uh orion I.t management product, which was backdoor to insert malware using a component with a inocuous name. Its name is name, was task host, w dot, exe.

A

This hack was codenamed sunspot by the analyst.

A

A

Anyway, people are uh offering me suggestions on how to uh make uh you know, share the screen, but I'm not since I'm on the other tab, where I'm looking at the presentation.

A

I have no way of really doing this right now, but anyway, the I go back to the solarwinds orion I.t management uh product, which was ubiquitous again because it was, it was used by many many enterprises.

A

The malware was codenamed sunspot by the analysts. It is not the name which was in the software itself, but because of the word solar winds. Obviously it was called sunspot.

A

uh The sun's sunspots does exactly what um ken thompson said. It you know was talking about. Basically, it monitors the running processes uh to see whether ms build.exe is uh running, and then it replaces one of the source files to include uh the backdoor cord, uh inserting, of course, things like uh pragma warnings off and turning the pragma warnings on and off which I've done myself.

A

In many cases to avoid spurious warnings and several safeguards were added to sunspot, to avoid the orient bills from failing, orion was chosen because it is used extensively in enterprises, both government and private. Actually,.

A

And, of course, after this uh hack and after the uh so, the primary hack must have involved compromise of some sort and allowing the attackers into the uh into the solarwinds uh build server, uh which is where all this stuff was being done and since it was extensively distributed to more than 18 000.

A

Well, the estimate is more between 18 000 and 30. 000 enterprises used the hacked version of the software, and I have these beautiful diagrams here, which talks about sunburst as a continuation of attacks that had already happened and were clearly documented and in this the software supply chain stack, which was you know, goes from system design, implementation, iterative testing and deployment.

A

The compromise could happen at various points and there were well-known pathways account access, uh compromise, stolen certificates, flawed cryptography code, injection, forged certificates, unsigned and broken signature systems, so all of these were could could have been involved, but sunburst was very interesting because it not only compromised.

A

uh I mean, as is usual, with the supply chain attacks. It not only compromises the build server of a commercial off the shelf software distributor, but obviously it goes into every place that software is used where they could install other they could drop other malware and hence break into all of the customers of the attack.

A

Obviously, the open source software is is a very, uh very high on the list of software to be compromised because it has such uh wide reach we'll go into that in detail uh later, but right now, I'm talking about the fact that they.

A

The attack is not on the solar winds, but on other systems, mostly the customer systems, and using that they all they they. The attack, spread laterally to microsoft, well in identity and access management systems using which they were able to do compromise a lot of the cloud uh system and they were going after specific intelligence like emails and other uh very sensitive topics. So this is a nation-state. Obviously,.

A

Attacking the infrastructure of the united states in this case, but it also uh spread to other countries.

A

So the main thing to note here is that many of the pathways used are were very commonly known, never fixed or never um never, adequately, addressed and and uh the software took.

A

um The software took a long time to properly launch, and so the uh obviously the attackers were very discreet in uh in covering their tracks and they they attack.

A

Well, the word attack implies, or even sunburst implies, a action that takes place in a very short period of time, but this this should really be something that uh you know should be used to describe something that happened over 8 months or 10 months, and that.

A

Persistence and patience and covering the tracks is what helped the attackers gain control over. So many so many systems.

A

If you go back to the, if you go back to the actual number of organizations compromised, 18 000 or so they only concentrated on a few. Obviously they didn't want to attack 18 000 organizations, uh 425 members of the u.s fortune, 500 systematic, systemically important vendors like microsoft and intel, and nearly a dozen u.s federal government agencies, including the departments of treasury, homeland security, state and energy, as well as state and local governments. So this is pretty much the entire software infrastructure of.

A

Governments and private companies when private companies say oh, we are, you know the governments get attacked because they are bureaucratic and so on. That is not true. They you know out of fortune, 500 425 members have been attacked uh and the linchpin services like identity and access management. Software from azure azure active directory were compromised to gain access to many user email accounts.

A

It was a cloud-based compromise, as well as a sign of a state actor with time, money, patience and discipline.

A

More than a I.t failure, this is a strategic failure for the united states. That is what some of the references that I have uh quoted say now coming to open source open source software is like uh the solar winds orion, because it is used everywhere, and if you, if you want some numbers, I can say that about 1.5 trillion, open source software downloads with requests were expected in 2020 and.

A

Many enterprise software components have a significant.

A

Portion of their software is open source.

A

And you know there is 430 percent year over year, growth in cyber attacks targeting open source software projects.

A

Nearly 40 percent of all npm packages rely on code with known vulnerabilities.

A

You know this is this is no way to uh proceed, because this open source, as you know, is a community resource just like a well and that's why this uh presentation is called the poison. Well, the a well is where every where everybody goes to drink and obviously, if the well is poisoned, everybody gets affected.

A

So software open source software is becoming more and more ubiquitous, not only regular software, but you know open source. So it is, it is an attack vector and we should be aware of it in hyperledger because we create we. We are the largest consortium of dlt technology, open source software, um but it's also well known that I mean not well known, but uh you know the statistics tell us uh that there is a separation between the people who act and the people who do not act.

A

That means exemplary projects are 530 times faster in updating dependencies and finding out the latest.

A

Vulnerabilities that have been uh released in their dependencies first of all.

A

The number of uh the first thing to do is to create a uh software bill of materials s-bomb, which is similar to the regular bill of materials for any any uh product, so that, if there's a problem in any of the supply, any of the any of the components of the software of the bill of materials, then you can trace it back to the source. And you can say: okay, you gotta, you gotta, have either a new component or or a way to address it. So we can.

A

We can start with a software bill of materials which is nothing but a list of all the dependencies, obviously not built by humans, but by using sca software component analysis uh like whiteboard white source bolt, and you can actually install it in the in your github repository.

A

I have fought several uh of high polisher projects.

A

uh I don't want to go into the details of what I found, but you can actually ins, install white source bolt and do a scan of the of the components and if the components in any of the dependency chains are found to be compromised, then the white source bolt would create an automatic uh issue for you, so that you have to fix it and s-bomb best practices, tools and expertise are being developed by nist and hyperledger repositories should have a develop a software bill of materials as part of our security and automate this and using tools that are freely available.

A

This is the this is the first thing that we can do and I have unfortunately run out of time almost so I'm going to go back to you guys and see whether you have any questions uh or anything that that I can hope to answer in the next few minutes, and I know that 22 people are watching.

A

I'm sorry that I was not able to share the screens. uh It started anyway. I I don't want to complain about this, but it's also very early here for 4 four thirty. So please uh chat and let me know how you like the session whether it's.

A

You know I I will end the session I'll leave because I don't know whether there's any other way to end the session. I hope you guys got something out of it.

A

Please put your uh stuff on chat. If you, if you did, that would be a great thing. Thank you.