Common Attack Patterns in Hardware

If infrastructure software is the brain, hardware is the skeletal system, and network forms the nerves of every organizational infrastructure, all are equally important for an entity to function normally. Likewise, software and hardware are critical to every company's normal functioning. The network hardware infrastructure is the core element for every business across market-wide sectors. It is a vital nerve center of an entire IT system precisely because it centralizes internal and external data and communications channels internally and externally.

Hardware is, therefore, an obvious target for all adversaries out there in the dark web, eyeing for sweet spots to get inside a corporate network. Since the internet is a "network of networks" that interconnects thousands of differently designed networks, it tends to get more and more complex with every other network in your infrastructure. Manipulating such networks can be easy for the adversaries but challenging to troubleshoot and inspect for a security analyst on the other end. With that said, let's look at a few common plausible hardware-based attacks that can be pretty fatal for any organization and, of course, measures to put in place to protect your hardware infrastructure from such cyber attacks.

Infrastructure Manipulation

Infrastructure manipulation is a simple, self-explanatory term described when an attacker tries to exploit the characteristics and traits of a specific network entity from one's organizational infrastructure to position an attack. This attack can vary from data exfiltration, manipulating the packet flow within a corporate network, or even hindering the network protocols from resulting in a complete network routing redirection. Adversaries monitor the target's vulnerable attack surface and identify the risk exposure to understand the magnitude of required attack preparation. All attacks begin with a reconnaissance phase wherein the attacker plans and gather as much information as necessary to launch an attack.

Infrastructure manipulation is further classified into several attack patterns such as;

• Cache Poisoning
  • In this type of attack pattern, the adversary or an attacker scans the target's DNS or public cache via sophisticated traffic sniffing tools to learn vulnerable elements in the target's cache.
  • Once the attacker has enough information to position a clickbait cache and send it to the target's public cache, the original public cache of the end-user is replaced with a bogus one only to manipulate the actual cache and respond to the end-user with negative responses.
  • However, there's an important characteristic to remember: these bogus caches can be nothing but botnets flooding the original cache enough so that the end-user falls prey, making the attacker succeed in finding a loophole within the target's corporate environment.

This attack is viral in targeting banks and hijacking financial systems to manipulate transactions and gain monetary advantages.

• Forced System to Reset Values

In this type of attack pattern, the adversary targets systems with weak or missing authentication metrics, systems with improper functioning of power state transition making it difficult to lock it down when required, and weak system module parameters with a reset function linked to them.

• The adversaries target such systems and use the infrastructure manipulation vector to trigger a system reset of such hardware systems.
• This makes me wonder why an attacker just system reset the values of a hardware system? How is the attacker benefitting out of it? Once the attacker executes a forced system reset of the values within a target hardware system, the hardware system resets all its configurations to factory settings.
• This ideally leads to a clean sweep to attack the hardware system that now holds no security configurations. Voila!

Hardware Integrity Attack

A hardware integrity attack is nothing but an attack pattern that exploits the system maintenance process, manipulates the product patch update component, and pushes in a malicious malware that eventually gets downloaded on all software and hardware systems that run the latest patch upgrade. How cool is that? Isn't it? This reminds me of the recent Solarwinds ransomware attack on the US Federal Government that shook their software and many hardware systems. Not to mention this flawless attack pattern also victimized various other biggies.

Abuse - Authentication / Privilege / Privilege Escalation

From a recent study conducted by a technology-based magazine for industrial systems, approximately 66% of the attacks creep in through corporate networks only by manipulating the authentication mechanism of a company. In this type of attack pattern, the adversary tries to obtain unauthorized access to an application, service, or device by taking advantage of a target organization's weak authentication mechanism or exploiting a vulnerability. For example, on May 7, 2021, Colonial Pipeline, an American oil pipeline system based in Texas, was targeted by attackers to position a ransomware attack on their computerized equipment systems. This attack used a compromised password to gain access to a VPN that enabled the attacker to access their corporate network remotely. This attack enabled the attacker to gain enough access to shutdown roughly around 2.5million barrels of fuel pipelines and position a DarkSide ransomware attack forcing the business executives to pay 4.4 million dollars in cryptocurrency to release the outage that lasted a few days.

Detection and Mitigation

Unknown to many organizations, such common weakness enumeration can be treated with enough care by bringing in the proper detection toolsets and following a few sets of security standards and best practices that must be implemented within every organization for their excellence.

Here are these few mitigation steps that security teams can plan and execute:

• Implement strong multi-factor authentication
• Introduce sophisticated toolsets to enable strong spam filters to prevent phishing attacks
• Implement sophisticated network filtering mechanisms
• Configure justified Fail-Safe and Fail-Secure modes
• Streamline regular system backups with timely Business Continuity Exercises and Audits.
• Isolate vulnerable OT and other critical hardware systems from the rest of the network
• Implement user awareness programs periodically

NIST CSF 800-53B and NIST Compliance Guide talks about best practices and measures that can be implemented to protect hardware systems from such common attack patterns.

Conclusion

With the introduction of every new network hardware system, adversaries are introducing attack patterns that can evade any hardware product using simple enumeration. Frequently, organizations focus on software applications that bring in revenue but neglect the nervous system, the network, and hardware systems. Demonstrating the dire attack patterns above makes it extremely important for organizations to focus on attack possibilities on routing and the complete network layer amongst the OSI layers. Nonetheless, management of these metrics can be overwhelming when organizations are not experienced enough to handle such intrinsic detection and mitigation measures. Cyber security consultants at FnCyber are here to help such organizations get through this awkward phase and achieve sophisticated cyber security measures.