Cybersecurity Leaders Are Talking A Lot About Counterfeit Devices

Malice Vs Greed

Most discussion about security in the supply chain has been focused on detecting tampering, or preventing backdoors or sneaky things being inserted into components and software. There’s another aspect emerging and will dwarf the tampering: devices that are counterfeited for profit indirectly causing security problems. Counterfeit devices are ones that either by design not what you think you are buying, or are mislabeled intentionally to make an older or different model appear to be a more desirable one. Like money, if it is printed by the forger or has a zero added to the number on a legitimate note neither is what you expected or paid for. The motivation is greed but there is a significant impact on security.

Counterfeit Devices Already A Big Issue in Healthcare and Hurt Security

Last year we studied the security of medical devices market. There’s a healthy and legitimate market for used medical devices. Not surprisingly newer devices command a higher price than older ones. The medical community wisely pushed for a universal barcode that formed a Unique Device Identifier (UDI), so devices can be inventoried, their ownership lineage known, and information about them collected (e.g. location). UDI should be a useful tool for security operations, such as patching. If the UDI tells me that this device is an XYZ version 2014 monitoring device, then I can make sure it is patched using the most recent accepted update.

So here is where greed, safety and security collide. Unscrupulous resellers can have counterfeit UDIs applied, making the older medical devices appear to be a newer vintage. Making that XYZ v2014 appear to be a more valuable v2018 can be big money with clear problems related to product recalls and paying too much. But applying a v2018 patch to a v2014 device can have unintended consequences such as bricking the device, leaving vulnerabilities open, or causing the device to malfunction. Desktop operation systems are robust, with dialogues and checks to minimize and usually avoid the misapplication of patches and updates. But almost all of IoT and a lot of medical devices don’t have that robustness. If you’ve ever ‘flashed the CMOS’ of a device, such as a router or camera you know it generally to be a black box process with little if no feedback. Swapped UDIs are part of the problem, with the other part being outright counterfeit devices that may or not have the same software.

This sounds kind of like a rare issue? Nuh uh. The World Health Organization estimates that about 8% of medical devices are counterfeit.

The Trends Making Counterfeiting A Bigger Temptation in Enterprise IT

Several forces are colliding and making this a concern. IoT growth is the big one. The proliferation of more devices joining enterprise networks and at a continually increasing rate means more new devices are being added, and more ‘dumb’ devices that are already on premises are becoming connected or ‘smart.’. Scale is an issue because the growth of IoT challenges traditional network inventory, SIEM, and patch management tools. So inventory and patch management is being strained and a lot slips through the cracks in most companies, and that aids the counterfeiters’ jobs.

The second change is Increased reliance on the ‘smartness’ IoT means that the IT aspects of Things are becoming a core capability: for example, the flow reporting via wireless of a pump is as valued as the function of the pump itself, and the electronic displays in cars are no longer only for entertainment but are now required for critical function such as speedometer and vehicle controls.

The third change is heterogeneity. There’s more brands of products and a faster rate of change in networks. Most enterprises have a multi-vendor network for their switches and routers already. Opening up branch offices to local internet has meant more brands and models. And there’s always more security appliances in the racks, especially in enterprises. Supply chain change means decreasing traditional procurement for enterprises, and the increased complexity of components sourcing for IT appliances and devices.

Why Is This A Bigger Security Concern Now?

All this scale, smartness and complexity means that there is an increased temptation and security impact for counterfeiting. Scale means falsely satisfying demand with older devices can be profitable but those devices may not operate correctly when patched, or cannot be patched at all. Counterfeit devices that are not patched or are designed less securely than the intended mean that smarter devices have a greater impact than when less interaction was the norm. Heterogeneity of components and supply chain means that there is a greater opportunity for counterfeiting, with it being harder to detect counterfeit components and there are more links in the supply chain involving more people with more potential for tampering.

Network and Security Devices Are the Next Wave of Counterfeiting

Counterfeit It and IoT components are bad enough, but there is an emerging greater threat. There have been recent cases seen where counterfeit security and networking devices have been sold: the very things that are the best line of defense against counterfeit devices and the security impact they can have are themselves being counterfeited. Using the counterfeit currency analogy, this is the equivalent of having counterfeits of the devices that scan currency to detect forgeries.

What Enterprises Need to Do

The best change that can be made is to make supply chain integrity includes counterfeit detection. In other words, whereas most supply chain integrity is not losing links in the chain, making sure those are valid links needs to be re-emphasized or added. High capability organizations are likely already doing this, but this is frankly rare. Changes in procurement can be a big part of this, including asking vendors what supply chain integrity steps they themselves take. It may mean “lowest cost” has to be amended to ‘lowest cost authentic.”

Most vulnerability management includes the inventory step (find what we have), and patch management. Increasing validation of inventory results can be a great first step. When the inventory is assumed, or based upon procurement it needs to have a validation step, i.e. we have 20 type Xv2 routers in the inventory let’s make sure those are really type X and v2.

Although the impacts of counterfeiting-for-greed won’t be only security related (e.g. malfunctioning medical devices), security organizations are the best positioned to lead these efforts.

Read More HERE