3. Nuclear supply chain cyber-attack surface
3.1. Overview
Similar to traditional kinetic warfare, the increasing sophistication of cyber-attacks has led to the development of improved cyber defense controls in NPPs, including changes in plant network architectures. Malicious actors often use the least secure and easiest pathway to launch a cyber-attack. Nuclear facilities are increasingly implementing one-way deterministic data diodes to prevent data and network communication into control networks from less secure networks. Since data diodes reduce the risk of internet-based attacks, there is an increased likelihood that adversaries intent on compromising CDAs will target less protected pathways, such as the supply chain. While the Triton malware attacks on the Triconex system were launched via insecure network architecture, it is possible that a sophisticated adversary could develop a similar attack by infiltrating the supply chain. In fact, Symantec reported that the number of software-based supply chain attacks in 2018 increased by 78% compared to the previous year due to increases in hijacked software update processes, compromised third-party libraries and services, and stolen credentials.
As the ubiquitous use of COTS components in digital I&C systems increases and the supply chain becomes progressively more globalized, adversarial focus has shifted towards exploiting vulnerabilities throughout the design and acquisition process. Supply chain attacks may use the same tactics, techniques, and procedures (TTPs) as other attack methods; the difference is that supply chain exploits can be introduced early in the product lifecycle such that they remain persistent and undetected until triggered. In addition, the use of commodity hardware and software lowers barriers of entry by enabling the adversary to use publicly available information to gain the knowledge necessary for successful exploits. The adversary may even have access to previously developed malware or attacks they can re-use in their campaign.
3.1.1. Supply chain vulnerabilities
I&C supply chain attacks are malicious actions or sabotage on hardware, firmware, software, or system information for the purpose of theft, counterfeiting, disruption, destruction, or compromise of the function or operation of the device. Tampering of systems can introduce malicious logic, hidden functionality, exploitable defects, or intentional backdoors for future cyber operations. In general, hardware, firmware, and system information are more susceptible to compromise during supply chain activities than during device installation and operation, while software is vulnerable throughout its entire lifecycle. Furthermore, attacks embedded into hardware and firmware are generally stealthier than software attacks, and they are often misidentified as design flaws or bugs.
While the global supply chain has shortened time-to-market, delivery speed, and component availability, this growth has resulted in expanded cyber risk from nation states. In 2019, Daniel Coats, the U.S. Director of National Intelligence, reported that China, Russia, Iran, and North Korea will increasingly use cyber espionage, attack, and influence to steal information and disrupt critical infrastructure. In addition, the U.S. Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency have issued alerts warning that the Chinese government is carrying out a cyber campaign against technology service providers and that the Russian government is involved in a multi-stage intrusion campaign targeting critical infrastructure sectors.
China is a global leader in technology and a leading provider of electronic components and electronic manufacturing. Chinese companies are not only often subsidized by the government, they are also legally required to work with them and their intelligence services. The IC market has grown dramatically with an annual 41% increase in 2017 to $699 billion. During the 10-year period prior to 2017, the U.S. reduced IC imports by 35%, while China increased imports by 247%. In 2017, China led the world with $207 billion IC exports while importing $80.1 billion ICs.
This shift of IC production away from the U.S. has reduced prices and increased availability in the global IC market. However, due to the known ongoing cyber campaigns, it has greatly increased vulnerability within the supply chain. In 2012, a U.S. Senate Armed Services Committee investigation found over one million suspect counterfeit electronic parts from China that were bound for critical military systems. As stated by Nissen et al. on the cyber vulnerabilities in the Department of Defense (DoD) supply chain, "we are in an era of adversarial asymmetric warfare for which we have no comprehensive defense". Although these reports were focused on vulnerabilities in the DoD electronics supply chain, the same concern with counterfeit and corrupted digital assets exists in all critical infrastructure sectors, including energy and nuclear power. In fact, due to findings that foreign adversaries are increasingly creating and exploiting vulnerabilities in the U.S. bulk-power system, the U.S. President signed Executive Order 13920 on May 1, 2020 to prohibit the acquisition, transfer, import, or installation onto the U.S. power grid any bulk-power system electric equipment that was designed, manufactured, or supplied by a foreign adversary that poses a risk to the bulk-power system or the security of the U.S. critical infrastructure. The current list of foreign adversaries includes China, Russia, Iran, Korea, and Venezuela. It is clear that the U.S.'s reliance on IC and electronics imports combined with the advancing threat of state-sponsored cyber campaigns has increased the risk of supply chain attacks in the U.S. nuclear fleet.
3.1.2. Hardware
Hardware includes microelectronic components such as ICs that are further manufactured or assembled into larger hardware devices (i.e., microprocessors, memory chips, logic chips) or other peripherals (i.e., expansion drives, communication controllers). Security breaches in the supply chain via direct access to hardware description languages, basic input/output system (BIOS) code, bitstream, logic, configuration files, or chip interfaces can enable adversaries to obtain confidential intellectual property (IP) information which can then be used to reverse engineer a device to develop hardware clones or counterfeits. A taxonomy of counterfeit parts includes recycled, remarked, overproduced, out-of-specification or defective, and cloned category types. It is estimated that 80% of reported counterfeits are recycled ICs.
Reverse engineering, testing, and side-channel analysis can also reveal confidential information and stored secrets, such as cryptographic authentication or encryption data for protected IP. In addition, physical access to the device could allow an adversary to tamper with hardware settings or introduce a Trojan horse or backdoor into the logic or circuitry. A hardware Trojan can impact C–I-A through functionality, specification, confidentiality, or DoS attacks. Functionality attacks may tamper with the inputs and outputs of a module, modify hardware computation, bypass existing security checks, or affect a communications channel. Specification attacks change parametric properties such as timing and power usage; confidentiality attacks occur by leaking sensitive or confidential information; and DoS attacks exhaust bandwidth, computation, or battery power to partially or permanently degrade or disable the device. Referring back to the intelligent transmitter in Fig. 1, a functionality attack could potentially modify hardware computation on the electronics board resulting in an inaccurate output signal.
The design and manufacturing lifecycle of an IC typically includes specification, design, fabrication, testing, and assembly stages. All stages are vulnerable to hardware attacks due to reliance on third parties, such as tool vendors, IP vendors, designers, and foundries. Hardware Trojans can be introduced directly onto the device or by compromising the tools and software used during the IC lifecycle. Additionally, hardware Trojans typically have two parts—a trigger and a payload. The trigger monitors the signals or events in a circuit. Once the expected condition is met, the payload, or malicious behavior, is activated. While there has not yet been a verified, publicly disclosed supply chain hardware Trojan attack, the large number of attacks proposed and demonstrated by the research community suggest that it is only a matter of time before adversaries adopt these TTPs.
3.1.3. Firmware
Firmware is the bridge between hardware and software; it runs higher level operations and controls basic functionality of the device, including communication, program execution, and device initialization. The firmware lifecycle typically includes design, processing, synthesis, verification, and configuration stages. The process is often iterative, interfacing with hardware fabrication to verify component operation.
By reverse engineering firmware, adversaries can learn the system, identify vulnerabilities, and corrupt code by alteration or insertion. Firmware can be reprogrammable and is, therefore, also vulnerable to supply chain attacks during routine updates or maintenance. For instance, an adversary can corrupt a firmware update package prior to installation on the device or a third-party service provider can directly add malicious code to the firmware during device maintenance. Firmware updates are often delivered as binaries without access to source code. In addition, vendors often deliberately obfuscate proprietary code to make it more difficult to compromise and steal. Both techniques make it hard for customers to verify the integrity of firmware updates.
Malicious firmware can hijack root access, steal data, affect device operation, and even disable the device similar in nature to the Shamoon cyber warfare virus, which was designed to make a device unusable by erasing its master boot record. In 2019, hackers developed ShadowHammer, a Trojan version of the ASUS Live Update Utility, which was distributed to victims through the application's own update tool. This utility updates the Unified Extensible Firmware Interface (UEFI) firmware, hardware drivers, and other ASUS tools. ShadowHammer targeted specific digital devices using tampered binaries signed with legitimate certificates to mask detection. A compromised UEFI provides an adversary full control over the device and can lead to propagation of additional malware, loss of sensitive information, and malfunction of the device.
Although secure architectures implemented in most nuclear facilities prevent automatic updates and reduce the risk of internet-based attacks, similar sophisticated and targeted firmware attacks are possible in air-gapped networks since testing and PMMD scanning may not detect the corrupted firmware prior to device update. For instance, an end user may download a firmware update package for the intelligent transmitter in Fig. 1 from the vendor, verify legitimacy using assumed valid certificates, and then transfer the updated, malicious firmware to the transmitter using a maintenance laptop. Once malicious code is inserted into firmware, it is often persistent and resilient—it can remain present even after the device is rebooted, software is reinstalled, or the device is rebuilt. Malicious firmware also usually remains undetected by traditional ITC tools that monitor the operating system or software.
3.1.4. Software
The software layer includes various operating systems, platforms, and packages used for I&C process control, Human-Machine Interfaces (HMIs), terminals, and application programming interfaces (APIs). Software used in I&C systems may include proprietary software, commercial software, and open-source software including third-party services or libraries. Software applications often contain numerous components. In 2019, Sonatype analyzed 500 applications and discovered that the average application contained over 450 software component releases, of which 85% were open source. Sonatype also reported that repository managers are used by over 9 million developers as part of their development tool set.
Software is vulnerable to compromise during all phases of its lifecycle, including supply chain activities such as design, development, and maintenance, as well as during normal operational use. Software supply chain attacks take many forms: malicious code may be inserted into legitimate software, credentials may be stolen, third-party libraries may be compromised, and software updates may be hijacked. The HeartBleed Bug infected a popular version of OpenSSL, a third-party, open-source library used to protect information communicated through the Transport Layer Security (TLS) protocol (CVE-2014-0160). Although TLS is not commonly used in control system communications, secure authentication features added to other process automation communication protocols could potentially be compromised in a similar manner.
Additionally, the Stuxnet attack against the Natanz uranium enrichment facility was enabled through the supply chain—it is speculated that the private keys of two manufacturing companies were stolen to enable valid digital signatures for the maliciously modified software. The subsequent introduction of the malware into the air-gapped network of the facility's control system caused destruction of centrifuges by oscillating the frequency of their operating speeds. As current NRC and NEI guidance does not adequately protect against supply chain attacks using stolen credentials, nuclear plants remain susceptible to attacks using these TTPs.
As with firmware, the software updating process can also be hijacked. In the 2014 Monju incident, an employee downloaded a software update on a computer connected to the business network in the control room of the Monju fast breeder reactor in Japan. The update package included a variant of the 'Gh0st RAT' Trojan that subsequently enabled exfiltration of corporate data to an external command and control (C2) server.