3._CRD Nuclear_AJ0 supply_NN1 chain_NN1 cyber-attack_NN1 surface_NN1 
3.1_CRD ._SENT Overview_NN1 
Similar_AJ0 to_PRP traditional_AJ0 kinetic_AJ0 warfare_NN1 ,_PUN the_AT0 increasing_AJ0 sophistication_NN1 of_PRF cyber-attacks_NN2 has_VHZ led_VVN to_PRP the_AT0 development_NN1 of_PRF improved_AJ0 cyber_AJ0 defense_NN1 controls_NN2 in_PRP NPPs_NP0 ,_PUN including_PRP changes_NN2 in_PRP plant_NN1 network_NN1 architectures_NN2 ._SENT Malicious_AJ0 actors_NN2 often_AV0 use_VVB the_AT0 least_AV0 secure_AJ0 and_CJC easiest_AJS pathway_NN1 to_TO0 launch_VVI a_AT0 cyber-attack_NN1 ._SENT Nuclear_AJ0 facilities_NN2 are_VBB increasingly_AV0 implementing_VVG one-way_AJ0 deterministic_AJ0 data_NN0 diodes_NN2 to_TO0 prevent_VVI data_NN0 and_CJC network_NN1 communication_NN1 into_PRP control_NN1 networks_NN2 from_PRP less_DT0 secure_AJ0 networks_NN2 ._SENT Since_CJS data_NN0 diodes_NN2 reduce_VVB the_AT0 risk_NN1 of_PRF internet-based_AJ0 attacks_NN2 ,_PUN there_EX0 is_VBZ an_AT0 increased_AJ0 likelihood_NN1 that_CJT adversaries_NN2 intent_AJ0 on_PRP compromising_AJ0 CDAs_NN2 will_VM0 target_VVI less_DT0 protected_AJ0 pathways_NN2 ,_PUN such_DT0 as_PRP the_AT0 supply_NN1 chain_NN1 ._SENT While_CJS the_AT0 Triton_NP0 malware_NN1 attacks_NN2 on_PRP the_AT0 Triconex_NP0 system_NN1 were_VBD launched_VVN via_PRP insecure_AJ0 network_NN1 architecture_NN1 ,_PUN it_PNP is_VBZ possible_AJ0 that_CJT a_AT0 sophisticated_AJ0 adversary_NN1 could_VM0 develop_VVI a_AT0 similar_AJ0 attack_NN1 by_PRP infiltrating_VVG the_AT0 supply_NN1 chain_NN1 ._SENT In_PRP fact_NN1 ,_PUN Symantec_NP0 reported_VVD that_CJT the_AT0 number_NN1 of_PRF software-based_AJ0 supply_NN1 chain_NN1 attacks_NN2 in_PRP 2018_CRD increased_VVN by_PRP 78_CRD %_NN0 compared_VVN to_PRP the_AT0 previous_AJ0 year_NN1 due_AJ0 to_PRP increases_NN2 in_PRP hijacked_AJ0 software_NN1 update_NN1 processes_NN2 ,_PUN compromised_VVD third-party_AJ0 libraries_NN2 and_CJC services_NN2 ,_PUN and_CJC stolen_AJ0 credentials_NN2 ._SENT 
As_CJS the_AT0 ubiquitous_AJ0 use_NN1 of_PRF COTS_NN2 components_NN2 in_PRP digital_AJ0 I_PNP &_VVB C_ZZ0 systems_NN2 increases_NN2 and_CJC the_AT0 supply_NN1 chain_NN1 becomes_VVZ progressively_AV0 more_AV0 globalized_AJ0 ,_PUN adversarial_AJ0 focus_NN1 has_VHZ shifted_VVN towards_PRP exploiting_VVG vulnerabilities_NN2 throughout_PRP the_AT0 design_NN1 and_CJC acquisition_NN1 process_NN1 ._SENT Supply_NN1 chain_NN1 attacks_NN2 may_VM0 use_VVI the_AT0 same_DT0 tactics_NN2 ,_PUN techniques_NN2 ,_PUN and_CJC procedures_NN2 (_PUL TTPs_NP0 )_PUR as_PRP other_AJ0 attack_NN1 methods_NN2 ;_PUN the_AT0 difference_NN1 is_VBZ that_CJT supply_NN1 chain_NN1 exploits_NN2 can_VM0 be_VBI introduced_VVN early_AV0 in_PRP the_AT0 product_NN1 lifecycle_NN1 such_DT0 that_CJT they_PNP remain_VVB persistent_AJ0 and_CJC undetected_AJ0 until_CJS triggered_VVN ._SENT In_PRP addition_NN1 ,_PUN the_AT0 use_NN1 of_PRF commodity_NN1 hardware_NN1 and_CJC software_NN1 lowers_VVZ barriers_NN2 of_PRF entry_NN1 by_PRP enabling_VVG the_AT0 adversary_NN1 to_TO0 use_VVI publicly_AV0 available_AJ0 information_NN1 to_TO0 gain_VVI the_AT0 knowledge_NN1 necessary_AJ0 for_PRP successful_AJ0 exploits_NN2 ._SENT The_AT0 adversary_NN1 may_VM0 even_AV0 have_VHI access_NN1 to_PRP previously_AV0 developed_AJ0 malware_NN1 or_CJC attacks_NN2 they_PNP can_VM0 re-use_VVI in_PRP their_DPS campaign_NN1 ._SENT 
3.1.1_CRD ._SENT Supply_NN1 chain_NN1 vulnerabilities_NN2 
I_PNP &_VVB C_ZZ0 supply_NN1 chain_NN1 attacks_NN2 are_VBB malicious_AJ0 actions_NN2 or_CJC sabotage_NN1 on_PRP hardware_NN1 ,_PUN firmware_NN1 ,_PUN software_NN1 ,_PUN or_CJC system_NN1 information_NN1 for_PRP the_AT0 purpose_NN1 of_PRF theft_NN1 ,_PUN counterfeiting_VVG ,_PUN disruption_NN1 ,_PUN destruction_NN1 ,_PUN or_CJC compromise_NN1 of_PRF the_AT0 function_NN1 or_CJC operation_NN1 of_PRF the_AT0 device_NN1 ._SENT Tampering_NN1 of_PRF systems_NN2 can_VM0 introduce_VVI malicious_AJ0 logic_NN1 ,_PUN hidden_AJ0 functionality_NN1 ,_PUN exploitable_AJ0 defects_NN2 ,_PUN or_CJC intentional_AJ0 backdoors_NN2 for_PRP future_AJ0 cyber_AJ0 operations_NN2 ._SENT In_PRP general_AJ0 ,_PUN hardware_NN1 ,_PUN firmware_NN1 ,_PUN and_CJC system_NN1 information_NN1 are_VBB more_AV0 susceptible_AJ0 to_TO0 compromise_VVI during_PRP supply_NN1 chain_NN1 activities_NN2 than_CJS during_PRP device_NN1 installation_NN1 and_CJC operation_NN1 ,_PUN while_CJS software_NN1 is_VBZ vulnerable_AJ0 throughout_PRP its_DPS entire_AJ0 lifecycle_NN1 ._SENT Furthermore_AV0 ,_PUN attacks_NN2 embedded_VVN into_PRP hardware_NN1 and_CJC firmware_NN1 are_VBB generally_AV0 stealthier_AJC than_CJS software_NN1 attacks_NN2 ,_PUN and_CJC they_PNP are_VBB often_AV0 misidentified_VVN as_PRP design_NN1 flaws_NN2 or_CJC bugs_NN2 ._SENT 
While_CJS the_AT0 global_AJ0 supply_NN1 chain_NN1 has_VHZ shortened_VVN time-to-market_NN1 ,_PUN delivery_NN1 speed_NN1 ,_PUN and_CJC component_NN1 availability_NN1 ,_PUN this_DT0 growth_NN1 has_VHZ resulted_VVN in_PRP expanded_AJ0 cyber_AJ0 risk_NN1 from_PRP nation_NN1 states_NN2 ._SENT In_PRP 2019_CRD ,_PUN Daniel_NP0 Coats_NP0 ,_PUN the_AT0 U.S._NP0 Director_NN1 of_PRF National_AJ0 Intelligence_NN1 ,_PUN reported_VVD that_CJT China_NP0 ,_PUN Russia_NP0 ,_PUN Iran_NP0 ,_PUN and_CJC North_NP0 Korea_NP0 will_VM0 increasingly_AV0 use_VVI cyber_AJ0 espionage_NN1 ,_PUN attack_NN1 ,_PUN and_CJC influence_VVB to_TO0 steal_VVI information_NN1 and_CJC disrupt_VVB critical_AJ0 infrastructure_NN1 ._SENT In_PRP addition_NN1 ,_PUN the_AT0 U.S._NP0 Department_NN1 of_PRF Homeland_NN1 Security_NN1 and_CJC the_AT0 Cybersecurity_NN1 and_CJC Infrastructure_NN1 Security_NN1 Agency_NN1 have_VHB issued_VVN alerts_NN2 warning_VVG that_CJT the_AT0 Chinese_AJ0 government_NN1 is_VBZ carrying_VVG out_AVP a_AT0 cyber_AJ0 campaign_NN1 against_PRP technology_NN1 service_NN1 providers_NN2 and_CJC that_CJT the_AT0 Russian_AJ0 government_NN1 is_VBZ involved_VVN in_PRP a_AT0 multi-stage_AJ0 intrusion_NN1 campaign_NN1 targeting_VVG critical_AJ0 infrastructure_NN1 sectors_NN2 ._SENT 
China_NP0 is_VBZ a_AT0 global_AJ0 leader_NN1 in_PRP technology_NN1 and_CJC a_AT0 leading_AJ0 provider_NN1 of_PRF electronic_AJ0 components_NN2 and_CJC electronic_AJ0 manufacturing_NN1 ._SENT Chinese_AJ0 companies_NN2 are_VBB not_XX0 only_AV0 often_AV0 subsidized_VVN by_PRP the_AT0 government_NN1 ,_PUN they_PNP are_VBB also_AV0 legally_AV0 required_VVN to_TO0 work_VVI with_PRP them_PNP and_CJC their_DPS intelligence_NN1 services_NN2 ._SENT The_AT0 IC_AJ0 market_NN1 has_VHZ grown_VVN dramatically_AV0 with_PRP an_AT0 annual_AJ0 41_CRD %_NN0 increase_NN1 in_PRP 2017_CRD to_PRP $_NN0 699_CRD billion_CRD ._SENT During_PRP the_AT0 10-year_AJ0 period_NN1 prior_AJ0 to_PRP 2017_CRD ,_PUN the_AT0 U.S._NP0 reduced_AJ0 IC_AJ0 imports_NN2 by_PRP 35_CRD %_NN0 ,_PUN while_CJS China_NP0 increased_VVD imports_NN2 by_PRP 247_CRD %_NN0 ._SENT In_PRP 2017_CRD ,_PUN China_NP0 led_VVD the_AT0 world_NN1 with_PRP $_NN0 207_CRD billion_CRD IC_AJ0 exports_NN2 while_CJS importing_VVG $_NN0 80.1_CRD billion_CRD ICs_NP0 ._SENT 
This_DT0 shift_NN1 of_PRF IC_AJ0 production_NN1 away_AV0 from_PRP the_AT0 U.S._NP0 has_VHZ reduced_VVN prices_NN2 and_CJC increased_AJ0 availability_NN1 in_PRP the_AT0 global_AJ0 IC_AJ0 market_NN1 ._SENT However_AV0 ,_PUN due_AJ0 to_PRP the_AT0 known_AJ0 ongoing_AJ0 cyber_NN1 campaigns_NN2 ,_PUN it_PNP has_VHZ greatly_AV0 increased_VVN vulnerability_NN1 within_PRP the_AT0 supply_NN1 chain_NN1 ._SENT In_PRP 2012_CRD ,_PUN a_AT0 U.S._NP0 Senate_NN1 Armed_AJ0 Services_NN2 Committee_NN1 investigation_NN1 found_VVN over_PRP one_CRD million_CRD suspect_VVB counterfeit_AJ0 electronic_AJ0 parts_NN2 from_PRP China_NP0 that_CJT were_VBD bound_VVN for_PRP critical_AJ0 military_AJ0 systems_NN2 ._SENT As_CJS stated_VVN by_PRP Nissen_NP0 et_NP0 al._NP0 on_PRP the_AT0 cyber_AJ0 vulnerabilities_NN2 in_PRP the_AT0 Department_NN1 of_PRF Defense_NN1 (_PUL DoD_NP0 )_PUR supply_NN1 chain_NN1 ,_PUN "_PUQ we_PNP are_VBB in_PRP an_AT0 era_NN1 of_PRF adversarial_AJ0 asymmetric_AJ0 warfare_NN1 for_PRP which_DTQ we_PNP have_VHB no_AT0 comprehensive_AJ0 defense_NN1 "_PUQ ._SENT Although_CJS these_DT0 reports_NN2 were_VBD focused_VVN on_PRP vulnerabilities_NN2 in_PRP the_AT0 DoD_NP0 electronics_NN1 supply_NN1 chain_NN1 ,_PUN the_AT0 same_DT0 concern_NN1 with_PRP counterfeit_AJ0 and_CJC corrupted_AJ0 digital_AJ0 assets_NN2 exists_VVZ in_PRP all_DT0 critical_AJ0 infrastructure_NN1 sectors_NN2 ,_PUN including_PRP energy_NN1 and_CJC nuclear_AJ0 power_NN1 ._SENT In_PRP fact_NN1 ,_PUN due_AJ0 to_PRP findings_NN2 that_CJT foreign_AJ0 adversaries_NN2 are_VBB increasingly_AV0 creating_VVG and_CJC exploiting_VVG vulnerabilities_NN2 in_PRP the_AT0 U.S._NP0 bulk-power_NN1 system_NN1 ,_PUN the_AT0 U.S._NP0 President_NP0 signed_VVD Executive_AJ0 Order_NN1 13920_CRD on_PRP May_NP0 1_CRD ,_PUN 2020_CRD to_TO0 prohibit_VVI the_AT0 acquisition_NN1 ,_PUN transfer_NN1 ,_PUN import_NN1 ,_PUN or_CJC installation_NN1 onto_PRP the_AT0 U.S._NP0 power_NN1 grid_NN1 any_DT0 bulk-power_NN1 system_NN1 electric_AJ0 equipment_NN1 that_CJT was_VBD designed_VVN ,_PUN manufactured_AJ0 ,_PUN or_CJC supplied_VVN by_PRP a_AT0 foreign_AJ0 adversary_NN1 that_CJT poses_VVZ a_AT0 risk_NN1 to_PRP the_AT0 bulk-power_NN1 system_NN1 or_CJC the_AT0 security_NN1 of_PRF the_AT0 U.S._NP0 critical_AJ0 infrastructure_NN1 ._SENT The_AT0 current_AJ0 list_NN1 of_PRF foreign_AJ0 adversaries_NN2 includes_VVZ China_NP0 ,_PUN Russia_NP0 ,_PUN Iran_NP0 ,_PUN Korea_NP0 ,_PUN and_CJC Venezuela_NP0 ._SENT It_PNP is_VBZ clear_AJ0 that_CJT the_AT0 U.S._NP0 's_POS reliance_NN1 on_PRP IC_NN1 and_CJC electronics_NN1 imports_NN2 combined_VVN with_PRP the_AT0 advancing_AJ0 threat_NN1 of_PRF state-sponsored_AJ0 cyber_AJ0 campaigns_NN2 has_VHZ increased_VVN the_AT0 risk_NN1 of_PRF supply_NN1 chain_NN1 attacks_NN2 in_PRP the_AT0 U.S._NP0 nuclear_AJ0 fleet_NN1 ._SENT 
3.1.2_CRD ._SENT Hardware_NN1 
Hardware_NN1 includes_VVZ microelectronic_AJ0 components_NN2 such_DT0 as_PRP ICs_NP0 that_CJT are_VBB further_AV0 manufactured_VVN or_CJC assembled_VVN into_PRP larger_AJC hardware_NN1 devices_NN2 (_PUL i.e._AV0 ,_PUN microprocessors_NN2 ,_PUN memory_NN1 chips_NN2 ,_PUN logic_NN1 chips_NN2 )_PUR or_CJC other_AJ0 peripherals_NN2 (_PUL i.e._AV0 ,_PUN expansion_NN1 drives_NN2 ,_PUN communication_NN1 controllers_NN2 )_PUR ._SENT Security_NN1 breaches_NN2 in_PRP the_AT0 supply_NN1 chain_NN1 via_PRP direct_AJ0 access_NN1 to_PRP hardware_NN1 description_NN1 languages_NN2 ,_PUN basic_AJ0 input_NN1 /_PUN output_NN1 system_NN1 (_PUL BIOS_NP0 )_PUR code_NN1 ,_PUN bitstream_NN1 ,_PUN logic_NN1 ,_PUN configuration_NN1 files_NN2 ,_PUN or_CJC chip_NN1 interfaces_NN2 can_VM0 enable_VVI adversaries_NN2 to_TO0 obtain_VVI confidential_AJ0 intellectual_AJ0 property_NN1 (_PUL IP_NP0 )_PUR information_NN1 which_DTQ can_VM0 then_AV0 be_VBI used_VVN to_TO0 reverse_VVI engineer_NN1 a_AT0 device_NN1 to_TO0 develop_VVI hardware_NN1 clones_NN2 or_CJC counterfeits_NN2 ._SENT A_AT0 taxonomy_NN1 of_PRF counterfeit_AJ0 parts_NN2 includes_VVZ recycled_AJ0 ,_PUN remarked_VVD ,_PUN overproduced_AJ0 ,_PUN out-of-specification_AJ0 or_CJC defective_AJ0 ,_PUN and_CJC cloned_AJ0 category_NN1 types_NN2 ._SENT It_PNP is_VBZ estimated_VVN that_CJT 80_CRD %_NN0 of_PRF reported_AJ0 counterfeits_NN2 are_VBB recycled_AJ0 ICs_NP0 ._SENT 
Reverse_AJ0 engineering_NN1 ,_PUN testing_NN1 ,_PUN and_CJC side-channel_AJ0 analysis_NN1 can_VM0 also_AV0 reveal_VVI confidential_AJ0 information_NN1 and_CJC stored_AJ0 secrets_NN2 ,_PUN such_DT0 as_PRP cryptographic_AJ0 authentication_NN1 or_CJC encryption_NN1 data_NN0 for_PRP protected_AJ0 IP_NN1 ._SENT In_PRP addition_NN1 ,_PUN physical_AJ0 access_NN1 to_PRP the_AT0 device_NN1 could_VM0 allow_VVI an_AT0 adversary_NN1 to_TO0 tamper_VVI with_PRP hardware_NN1 settings_NN2 or_CJC introduce_VVB a_AT0 Trojan_AJ0 horse_NN1 or_CJC backdoor_NN1 into_PRP the_AT0 logic_NN1 or_CJC circuitry_NN1 ._SENT A_AT0 hardware_NN1 Trojan_NN1 can_VM0 impact_NN1 C_ZZ0 –_PUN I-A_NN1 through_PRP functionality_NN1 ,_PUN specification_NN1 ,_PUN confidentiality_NN1 ,_PUN or_CJC DoS_NN1 attacks_NN2 ._SENT Functionality_NN1 attacks_NN2 may_VM0 tamper_VVI with_PRP the_AT0 inputs_NN2 and_CJC outputs_NN2 of_PRF a_AT0 module_NN1 ,_PUN modify_VVB hardware_NN1 computation_NN1 ,_PUN bypass_VVB existing_AJ0 security_NN1 checks_NN2 ,_PUN or_CJC affect_VVB a_AT0 communications_NN2 channel_NN1 ._SENT Specification_NN1 attacks_NN2 change_VVB parametric_AJ0 properties_NN2 such_DT0 as_PRP timing_NN1 and_CJC power_NN1 usage_NN1 ;_PUN confidentiality_NN1 attacks_NN2 occur_VVB by_PRP leaking_VVG sensitive_AJ0 or_CJC confidential_AJ0 information_NN1 ;_PUN and_CJC DoS_NP0 attacks_NN2 exhaust_NN1 bandwidth_NN1 ,_PUN computation_NN1 ,_PUN or_CJC battery_NN1 power_NN1 to_PRP partially_AV0 or_CJC permanently_AV0 degrade_VVB or_CJC disable_VVB the_AT0 device_NN1 ._SENT Referring_VVG back_AVP to_PRP the_AT0 intelligent_AJ0 transmitter_NN1 in_PRP Fig._NN1 1_CRD ,_PUN a_AT0 functionality_NN1 attack_NN1 could_VM0 potentially_AV0 modify_VVI hardware_NN1 computation_NN1 on_PRP the_AT0 electronics_NN1 board_NN1 resulting_VVG in_PRP an_AT0 inaccurate_AJ0 output_NN1 signal_NN1 ._SENT 
The_AT0 design_NN1 and_CJC manufacturing_NN1 lifecycle_NN1 of_PRF an_AT0 IC_NN1 typically_AV0 includes_VVZ specification_NN1 ,_PUN design_NN1 ,_PUN fabrication_NN1 ,_PUN testing_NN1 ,_PUN and_CJC assembly_NN1 stages_NN2 ._SENT All_DT0 stages_NN2 are_VBB vulnerable_AJ0 to_PRP hardware_NN1 attacks_NN2 due_AJ0 to_PRP reliance_NN1 on_PRP third_ORD parties_NN2 ,_PUN such_DT0 as_PRP tool_NN1 vendors_NN2 ,_PUN IP_NN1 vendors_NN2 ,_PUN designers_NN2 ,_PUN and_CJC foundries_NN2 ._SENT Hardware_NN1 Trojans_NN2 can_VM0 be_VBI introduced_VVN directly_AV0 onto_PRP the_AT0 device_NN1 or_CJC by_PRP compromising_VVG the_AT0 tools_NN2 and_CJC software_NN1 used_VVN during_PRP the_AT0 IC_AJ0 lifecycle_NN1 ._SENT Additionally_AV0 ,_PUN hardware_NN1 Trojans_NN2 typically_AV0 have_VHB two_CRD parts_NN2 —_PUN a_AT0 trigger_NN1 and_CJC a_AT0 payload_NN1 ._SENT The_AT0 trigger_NN1 monitors_VVZ the_AT0 signals_NN2 or_CJC events_NN2 in_PRP a_AT0 circuit_NN1 ._SENT Once_CJS the_AT0 expected_AJ0 condition_NN1 is_VBZ met_VVN ,_PUN the_AT0 payload_NN1 ,_PUN or_CJC malicious_AJ0 behavior_NN1 ,_PUN is_VBZ activated_VVN ._SENT While_CJS there_EX0 has_VHZ not_XX0 yet_AV0 been_VBN a_AT0 verified_AJ0 ,_PUN publicly_AV0 disclosed_VVN supply_NN1 chain_NN1 hardware_NN1 Trojan_AJ0 attack_NN1 ,_PUN the_AT0 large_AJ0 number_NN1 of_PRF attacks_NN2 proposed_VVN and_CJC demonstrated_VVN by_PRP the_AT0 research_NN1 community_NN1 suggest_VVB that_CJT it_PNP is_VBZ only_AV0 a_AT0 matter_NN1 of_PRF time_NN1 before_CJS adversaries_NN2 adopt_VVB these_DT0 TTPs_NN2 ._SENT 
3.1.3_CRD ._SENT Firmware_NN1 
Firmware_NN1 is_VBZ the_AT0 bridge_NN1 between_PRP hardware_NN1 and_CJC software_NN1 ;_PUN it_PNP runs_VVZ higher_AJC level_NN1 operations_NN2 and_CJC controls_NN2 basic_AJ0 functionality_NN1 of_PRF the_AT0 device_NN1 ,_PUN including_PRP communication_NN1 ,_PUN program_NN1 execution_NN1 ,_PUN and_CJC device_NN1 initialization_NN1 ._SENT The_AT0 firmware_NN1 lifecycle_NN1 typically_AV0 includes_VVZ design_NN1 ,_PUN processing_NN1 ,_PUN synthesis_NN1 ,_PUN verification_NN1 ,_PUN and_CJC configuration_NN1 stages_NN2 ._SENT The_AT0 process_NN1 is_VBZ often_AV0 iterative_AJ0 ,_PUN interfacing_VVG with_PRP hardware_NN1 fabrication_NN1 to_TO0 verify_VVI component_NN1 operation_NN1 ._SENT 
By_PRP reverse_AJ0 engineering_NN1 firmware_NN1 ,_PUN adversaries_NN2 can_VM0 learn_VVI the_AT0 system_NN1 ,_PUN identify_VVB vulnerabilities_NN2 ,_PUN and_CJC corrupt_AJ0 code_NN1 by_PRP alteration_NN1 or_CJC insertion_NN1 ._SENT Firmware_NN1 can_VM0 be_VBI reprogrammable_AJ0 and_CJC is_VBZ ,_PUN therefore_AV0 ,_PUN also_AV0 vulnerable_AJ0 to_TO0 supply_VVI chain_NN1 attacks_NN2 during_PRP routine_AJ0 updates_NN2 or_CJC maintenance_NN1 ._SENT For_PRP instance_NN1 ,_PUN an_AT0 adversary_NN1 can_VM0 corrupt_AJ0 a_AT0 firmware_NN1 update_NN1 package_NN1 prior_AJ0 to_PRP installation_NN1 on_PRP the_AT0 device_NN1 or_CJC a_AT0 third-party_AJ0 service_NN1 provider_NN1 can_VM0 directly_AV0 add_VVI malicious_AJ0 code_NN1 to_PRP the_AT0 firmware_NN1 during_PRP device_NN1 maintenance_NN1 ._SENT Firmware_NN1 updates_NN2 are_VBB often_AV0 delivered_VVN as_PRP binaries_NN2 without_PRP access_NN1 to_PRP source_NN1 code_NN1 ._SENT In_PRP addition_NN1 ,_PUN vendors_NN2 often_AV0 deliberately_AV0 obfuscate_VVB proprietary_AJ0 code_NN1 to_TO0 make_VVI it_PNP more_AV0 difficult_AJ0 to_TO0 compromise_VVI and_CJC steal_VVI ._SENT Both_DT0 techniques_NN2 make_VVB it_PNP hard_AJ0 for_PRP customers_NN2 to_TO0 verify_VVI the_AT0 integrity_NN1 of_PRF firmware_NN1 updates_NN2 ._SENT 
Malicious_AJ0 firmware_NN1 can_VM0 hijack_VVI root_NN1 access_NN1 ,_PUN steal_VVB data_NN0 ,_PUN affect_VVB device_NN1 operation_NN1 ,_PUN and_CJC even_AV0 disable_VVB the_AT0 device_NN1 similar_AJ0 in_PRP nature_NN1 to_PRP the_AT0 Shamoon_NP0 cyber_NN1 warfare_NN1 virus_NN1 ,_PUN which_DTQ was_VBD designed_VVN to_TO0 make_VVI a_AT0 device_NN1 unusable_AJ0 by_PRP erasing_VVG its_DPS master_NN1 boot_NN1 record_NN1 ._SENT In_PRP 2019_CRD ,_PUN hackers_NN2 developed_VVD ShadowHammer_NP0 ,_PUN a_AT0 Trojan_AJ0 version_NN1 of_PRF the_AT0 ASUS_NN1 Live_AJ0 Update_NN1 Utility_NN1 ,_PUN which_DTQ was_VBD distributed_VVN to_PRP victims_NN2 through_PRP the_AT0 application_NN1 's_POS own_DT0 update_NN1 tool_NN1 ._SENT This_DT0 utility_NN1 updates_VVZ the_AT0 Unified_AJ0 Extensible_AJ0 Firmware_NN1 Interface_NN1 (_PUL UEFI_NP0 )_PUR firmware_NN1 ,_PUN hardware_NN1 drivers_NN2 ,_PUN and_CJC other_AJ0 ASUS_NN1 tools_NN2 ._SENT ShadowHammer_NP0 targeted_VVD specific_AJ0 digital_AJ0 devices_NN2 using_VVG tampered_AJ0 binaries_NN2 signed_VVN with_PRP legitimate_AJ0 certificates_NN2 to_TO0 mask_VVI detection_NN1 ._SENT A_AT0 compromised_AJ0 UEFI_NN1 provides_VVZ an_AT0 adversary_NN1 full_AJ0 control_NN1 over_PRP the_AT0 device_NN1 and_CJC can_VM0 lead_VVI to_PRP propagation_NN1 of_PRF additional_AJ0 malware_NN1 ,_PUN loss_NN1 of_PRF sensitive_AJ0 information_NN1 ,_PUN and_CJC malfunction_NN1 of_PRF the_AT0 device_NN1 ._SENT 
Although_CJS secure_AJ0 architectures_NN2 implemented_VVN in_PRP most_DT0 nuclear_AJ0 facilities_NN2 prevent_VVB automatic_AJ0 updates_NN2 and_CJC reduce_VVB the_AT0 risk_NN1 of_PRF internet-based_AJ0 attacks_NN2 ,_PUN similar_AJ0 sophisticated_AJ0 and_CJC targeted_AJ0 firmware_NN1 attacks_NN2 are_VBB possible_AJ0 in_PRP air-gapped_AJ0 networks_NN2 since_PRP testing_NN1 and_CJC PMMD_NN1 scanning_NN1 may_VM0 not_XX0 detect_VVI the_AT0 corrupted_AJ0 firmware_NN1 prior_AJ0 to_PRP device_NN1 update_NN1 ._SENT For_PRP instance_NN1 ,_PUN an_AT0 end_NN1 user_NN1 may_VM0 download_VVI a_AT0 firmware_NN1 update_NN1 package_NN1 for_PRP the_AT0 intelligent_AJ0 transmitter_NN1 in_PRP Fig._NN1 1_CRD from_PRP the_AT0 vendor_NN1 ,_PUN verify_VVB legitimacy_NN1 using_VVG assumed_AJ0 valid_AJ0 certificates_NN2 ,_PUN and_CJC then_AV0 transfer_VVB the_AT0 updated_AJ0 ,_PUN malicious_AJ0 firmware_NN1 to_PRP the_AT0 transmitter_NN1 using_VVG a_AT0 maintenance_NN1 laptop_NN1 ._SENT Once_AV0 malicious_AJ0 code_NN1 is_VBZ inserted_VVN into_PRP firmware_NN1 ,_PUN it_PNP is_VBZ often_AV0 persistent_AJ0 and_CJC resilient_AJ0 —_PUN it_PNP can_VM0 remain_VVI present_AJ0 even_AV0 after_PRP the_AT0 device_NN1 is_VBZ rebooted_VVN ,_PUN software_NN1 is_VBZ reinstalled_VVN ,_PUN or_CJC the_AT0 device_NN1 is_VBZ rebuilt_VVN ._SENT Malicious_AJ0 firmware_NN1 also_AV0 usually_AV0 remains_VVZ undetected_AJ0 by_PRP traditional_AJ0 ITC_NN1 tools_NN2 that_CJT monitor_VVB the_AT0 operating_NN1 system_NN1 or_CJC software_NN1 ._SENT 
3.1.4_CRD ._SENT Software_NN1 
The_AT0 software_NN1 layer_NN1 includes_VVZ various_AJ0 operating_NN1 systems_NN2 ,_PUN platforms_NN2 ,_PUN and_CJC packages_NN2 used_VVN for_PRP I_PNP &_NP0 C_ZZ0 process_NN1 control_NN1 ,_PUN Human-Machine_AJ0 Interfaces_NN2 (_PUL HMIs_NP0 )_PUR ,_PUN terminals_NN2 ,_PUN and_CJC application_NN1 programming_NN1 interfaces_NN2 (_PUL APIs_NP0 )_PUR ._SENT Software_NN1 used_VVN in_PRP I_PNP &_NP0 C_ZZ0 systems_NN2 may_VM0 include_VVI proprietary_AJ0 software_NN1 ,_PUN commercial_AJ0 software_NN1 ,_PUN and_CJC open-source_AJ0 software_NN1 including_PRP third-party_AJ0 services_NN2 or_CJC libraries_NN2 ._SENT Software_NN1 applications_NN2 often_AV0 contain_VVB numerous_AJ0 components_NN2 ._SENT In_PRP 2019_CRD ,_PUN Sonatype_NP0 analyzed_VVD 500_CRD applications_NN2 and_CJC discovered_VVD that_CJT the_AT0 average_AJ0 application_NN1 contained_VVN over_PRP 450_CRD software_NN1 component_NN1 releases_NN2 ,_PUN of_PRF which_DTQ 85_CRD %_NN0 were_VBD open_AJ0 source_NN1 ._SENT Sonatype_NP0 also_AV0 reported_VVD that_CJT repository_NN1 managers_NN2 are_VBB used_VVN by_PRP over_AV0 9_CRD million_CRD developers_NN2 as_PRP part_NN1 of_PRF their_DPS development_NN1 tool_NN1 set_NN1 ._SENT 
Software_NN1 is_VBZ vulnerable_AJ0 to_TO0 compromise_VVI during_PRP all_DT0 phases_NN2 of_PRF its_DPS lifecycle_NN1 ,_PUN including_PRP supply_NN1 chain_NN1 activities_NN2 such_DT0 as_PRP design_NN1 ,_PUN development_NN1 ,_PUN and_CJC maintenance_NN1 ,_PUN as_CJS well_AV0 as_CJS during_PRP normal_AJ0 operational_AJ0 use_NN1 ._SENT Software_NN1 supply_NN1 chain_NN1 attacks_NN2 take_VVB many_DT0 forms_NN2 :_PUN malicious_AJ0 code_NN1 may_VM0 be_VBI inserted_VVN into_PRP legitimate_AJ0 software_NN1 ,_PUN credentials_NN2 may_VM0 be_VBI stolen_VVN ,_PUN third-party_AJ0 libraries_NN2 may_VM0 be_VBI compromised_VVN ,_PUN and_CJC software_NN1 updates_NN2 may_VM0 be_VBI hijacked_VVN ._SENT The_AT0 HeartBleed_AJ0 Bug_NN1 infected_VVD a_AT0 popular_AJ0 version_NN1 of_PRF OpenSSL_NN1 ,_PUN a_AT0 third-party_AJ0 ,_PUN open-source_AJ0 library_NN1 used_VVN to_TO0 protect_VVI information_NN1 communicated_VVN through_PRP the_AT0 Transport_NN1 Layer_NN1 Security_NN1 (_PUL TLS_NP0 )_PUR protocol_NN1 (_PUL CVE-2014-0160_CRD )_PUR ._SENT Although_CJS TLS_NP0 is_VBZ not_XX0 commonly_AV0 used_VVN in_PRP control_NN1 system_NN1 communications_NN2 ,_PUN secure_AJ0 authentication_NN1 features_NN2 added_VVN to_PRP other_AJ0 process_NN1 automation_NN1 communication_NN1 protocols_NN2 could_VM0 potentially_AV0 be_VBI compromised_VVN in_PRP a_AT0 similar_AJ0 manner_NN1 ._SENT 
Additionally_AV0 ,_PUN the_AT0 Stuxnet_NP0 attack_NN1 against_PRP the_AT0 Natanz_NP0 uranium_NN1 enrichment_NN1 facility_NN1 was_VBD enabled_VVN through_PRP the_AT0 supply_NN1 chain_NN1 —_PUN it_PNP is_VBZ speculated_VVN that_CJT the_AT0 private_AJ0 keys_NN2 of_PRF two_CRD manufacturing_NN1 companies_NN2 were_VBD stolen_VVN to_TO0 enable_VVI valid_AJ0 digital_AJ0 signatures_NN2 for_PRP the_AT0 maliciously_AV0 modified_AJ0 software_NN1 ._SENT The_AT0 subsequent_AJ0 introduction_NN1 of_PRF the_AT0 malware_NN1 into_PRP the_AT0 air-gapped_AJ0 network_NN1 of_PRF the_AT0 facility_NN1 's_POS control_NN1 system_NN1 caused_VVN destruction_NN1 of_PRF centrifuges_NN2 by_PRP oscillating_VVG the_AT0 frequency_NN1 of_PRF their_DPS operating_NN1 speeds_NN2 ._SENT As_PRP current_AJ0 NRC_NP0 and_CJC NEI_NP0 guidance_NN1 does_VDZ not_XX0 adequately_AV0 protect_VVI against_PRP supply_NN1 chain_NN1 attacks_NN2 using_VVG stolen_AJ0 credentials_NN2 ,_PUN nuclear_AJ0 plants_NN2 remain_VVB susceptible_AJ0 to_PRP attacks_NN2 using_VVG these_DT0 TTPs_NN2 ._SENT 
As_CJS with_PRP firmware_NN1 ,_PUN the_AT0 software_NN1 updating_NN1 process_NN1 can_VM0 also_AV0 be_VBI hijacked_VVN ._SENT In_PRP the_AT0 2014_CRD Monju_NP0 incident_NN1 ,_PUN an_AT0 employee_NN1 downloaded_VVD a_AT0 software_NN1 update_NN1 on_PRP a_AT0 computer_NN1 connected_VVN to_PRP the_AT0 business_NN1 network_NN1 in_PRP the_AT0 control_NN1 room_NN1 of_PRF the_AT0 Monju_NP0 fast_AJ0 breeder_NN1 reactor_NN1 in_PRP Japan_NP0 ._SENT The_AT0 update_NN1 package_NN1 included_VVD a_AT0 variant_NN1 of_PRF the_AT0 '_PUQ Gh0st_NP0 RAT_NN1 '_POS Trojan_NN1 that_CJT subsequently_AV0 enabled_VVD exfiltration_NN1 of_PRF corporate_AJ0 data_NN0 to_PRP an_AT0 external_AJ0 command_NN1 and_CJC control_NN1 (_PUL C2_CRD )_PUR server_NN1 ._SENT 
