How AI can fend off supply-chain attacks

March 25, 2022 TH Author

Paid feature Of all the things that have value in business, trust is one of the most important. We tend to trust those that we work with closely, giving them easier access to our precious infrastructure.

Criminals know this, which is why they’ve tried for years to co-opt trust for their own ends. They do it every time they spoof emails from colleagues and contacts. If an email comes from someone you know, you’re more likely to believe it.

Weaponizing trust

Now, the weaponization of trust has reached new levels with the evolution of supply chain fraud. These attacks exploit companies’ trust in their vendors and partners. Criminals compromise suppliers’ accounts, using them as easy routes into customer networks.

In January this year, cybersecurity company Darktrace predicted that this supply chain fraud would overtake CEO fraud. It reasoned that companies are getting wise to fraud attacks against their senior C-suite executives and are putting protective measures in place that make them difficult to reach. So it makes more sense for attackers to target other parties that a company trusts – such as its suppliers.

Supplier-borne compromises are especially fruitful for online thieves because they often enable mass downstream compromise. One compromised supplier could be a conduit for distributing ransomware to customers.

That’s just what happened in July 2021. The REvil ransomware group took down hundreds of companies with its attack against network management services company Kaseya. A flaw in its remote management software let hackers use it to distribute its ransomware to its customers’ servers. One authentication flaw led to a multi-stage attack that stopped operations at companies including grocery stores half a world away.

That was bad enough, but even worse is the nuclear scenario: a stealthier attack could compromise the supplier’s own digital product or service. The attacker could turn legitimate software into a trojan horse that could disrupt services or steal information from an entire customer base.

We saw this most clearly with the attack that rocked Solarwinds and its customers in December 2020. Hackers, believed to be Russian, compromised the company’s development systems and introduced security flaws directly into its software. Those then compromised hundreds of customer systems, including those of US government agencies. The attackers had been in these systems for months before someone spotted the problem.

Vendor email compromise

These are examples of supply chain compromises that infiltrate a company’s software directly, but there’s another common attack vector; email. Vendor email compromise (VEC) is a big risk for companies.

A VEC attacker uses compromised user accounts to send malicious emails to the victim’s own customers. That email could contain a bogus invoice with details for a fraudulent bank account. Nigerian Group Silent Starling has been using that technique since at least 2019.

It could also give a phisher access to clients’ own systems. Indian outsourcing company Wipro suffered from such an attack in 2019. Researchers subsequently found the same hacking group targeting other large companies with VEC attacks.

The shortcomings of traditional tools

A VEC is the ultimate weaponization of trust. Compromising a supplier who communicates with a company regularly gives attackers an advantage. When an email comes from a familiar supplier address, employees are more likely to let their guard down.

Traditional email scanners have a hard time spotting VECs. They use rules-based technology to spot known malicious domains and IPs. Those indicators of compromise come from threat intelligence feeds and blacklists, and a supplier’s domain or IP won’t be on them. While a phishing link might trigger an alert, phishers increasingly use bulk registration and short domain life cycles to avoid falling foul of blacklists.

So the VEC is a wolf in sheep’s clothing. How can you filter it from the herd of legitimate emails entering your systems? Darktrace argues that it’s time for a new approach. If the emails don’t match known IoCs, then it’s time to look for something else.

The company uses machine learning to build up a picture of normal email patterns across an organization, including metadata and content. It also develops a baseline of normal network traffic. These patterns of normal behavior adapt gradually as the company’s communication and traffic evolve. It enables the company to maintain a picture of what’s normal in a technique that it calls ‘self-learning AI’.

Understanding what’s normal helps the company’s detection and response system recognise deviations from that baseline. That casts everything in a new light, including emails that come from legitimate accounts.

How AI helps spot suspicious supplier emails

Whereas a traditional email scanning tool looking for an IoC match might miss an email from a supplier’s account, Darktrace argues that looking for even minute deviations from normal can throw up red flags. An email from a supplier with suspicious language or with links that the company has never seen before might be cause for alarm.

The company’s Antigena self-learning AI tool helped spot a VEC at racing team McLaren. Attackers used a supply chain ruse to target 12 employees there with phishing emails. Key people including technical directors and accounts payable staff got an email supposedly from a team supplier.

The email enticed users with a supposed voicemail. It included a link that took victims to a phishing site requesting their Office 365 credentials.

Antigena scanned the content of the email and compared it to other emails that the real supplier had sent in the past. Several factors caused it to flag the email, including the link to the phishing site, which hadn’t shown up in any of McLaren’s network traffic in the past. The attacker’s use of text to mask the link also made Antigena more suspicious, giving it an anomaly score of 100 percent. That was enough to keep it out of the recipients’ inboxes.

The key factor here was that the malicious emails really were from the supplier, rather than from a spoofed address or a look-alike domain. Not only did the product block the suspicious emails, but it let through other legitimate communications from the company.

The next day, the supplier warned McLaren that someone had compromised one of its email accounts and had sent out the phishing emails.

“This is reflective of a wider pattern noticed by the security team,” says Ed Green, who works at McLaren integrating technology partners into the racing team’s ecosystem. “Attackers are targeting suppliers because they represent a single key that opens potentially dozens or even hundreds of locks, and email is just one avenue of attack.”

He also recalls another malicious email that spoofed a sponsor’s address and tried to pilfer login credentials from a senior executive at McLaren. Antigena stopped it cold, he recalls. Darktrace believes that McLaren’s other security tools would only catch around 40 percent of the attacks it spots for the company.

Spotting trojan horse software

Darktrace believes that it can stop more than just VEC supply chain attacks with its technology. An attacker who infiltrates a company using compromised supplier software will usually do unusual things. While they might be able to fly under conventional monitoring systems’ radar, the company believes that self-learning AI is smart enough to spot them.

The company has detailed how its products can spot anomalous behavior related to the SolarWinds compromise. In many of these attacks, human attackers configured compromised systems to mask their activities. For example, they’d ensure that victims’ computers connected to locally-based command and control (C2) servers so that admins wouldn’t be alerted by connections to IP blocks in unusual locations. Darktrace would still notice a victim’s computer beaconing to a new endpoint, it explains.

With supply chain attackers using multiple routes into victims’ systems, Darktrace argues that a multi-faceted approach to monitoring is crucial. Its product adopts a unified picture of both email and network traffic, enabling it to spot deviations in packet flow or email content.

As attackers get more adept at evading detection, this AI technique adopts a perspective that goes beyond mere good and bad, using probabilistic scores to determine the likelihood of malice and its potential effect on the company’s systems.

Today, you don’t really know who’s controlling a trusted provider’s account or what’s lurking in its software. With less certainty than ever about what’s entering your network, Darktrace’s customers are banking on a new way of detecting digital toxins – whoever they come from.

Sponsored by Darktrace.