Details emerge on cybersecurity supply chain attack Operation ShadowHammer

Kaspersky Lab has uncovered a new advanced persistent threat (APT) campaign that has affected many users through what is known as a supply chain attack, the company reported Monday.

According to Kaspersky Lab, research found that threat actors behind Operation ShadowHammer targeted users of the ASUS Live Update Utility, by injecting a backdoor into it at least between June and November 2018. Kaspersky Lab experts estimate that the attack may have affected more than a million users worldwide, the company stated.


Subscribe to SAE’s growing collections of standards, papers, journals, books, and more for:


The company pointed about that a supply chain attack is one of the most dangerous and effective infection vectors, increasingly exploited in advanced operations over the last few years – as they have seen with ShadowPad or CCleaner. There attacks targets specific weaknesses in the interconnected systems of human, organizational, material, and intellectual resources involved in the product life cycle: from initial development stage through to the end user. While a vendor’s infrastructure can be secure, they point out, there could be vulnerabilities in its providers’ facilities that would sabotage the supply chain, leading to a devastating and unexpected data breach.


Read More: The value of car hacking


The actors behind ShadowHammer targeted the ASUS Live Update Utility as the initial source of infection. According to the Kaspersky, this is a pre-installed utility in most new ASUS computers, for automatic BIOS, UEFI, drivers and applications updates. Using stolen digital certificates used by ASUS to sign legitimate binaries, the attackers have tampered older versions of ASUS software, injecting their own malicious code. Trojanized versions of the utility were signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to most protection solutions.

“The selected vendors are extremely attractive targets for APT groups that might want to take advantage of their vast customer base. It is not yet very clear what the ultimate goal of the attackers was, and we are still researching who was behind the attack. However, techniques used to achieve unauthorized code execution, as well as other discovered artefacts suggest that ShadowHammer is probably related to the BARIUM APT, which was previously linked to the ShadowPad and CCleaner incidents, among others. This new campaign is yet another example of how sophisticated and dangerous a smart supply chain attack can be nowadays,” said Vitaly Kamluk, Director of Global Research and Analysis Team.


Read More: Special Report: Securing the Modern Vehicle: A Study of Automotive Industry Cybersecurity Practices


According to Kaspersky, this attack has far reaching implications. They point out that while this means that potentially every user of the affected software could have become a victim, actors behind ShadowHammer were focused on gaining access to several hundreds of users, which they had prior knowledge about. According to Kaspersky Lab, researchers discovered that each backdoor code contained a table of hardcoded MAC addresses – the unique identifier of network adapters used to connect a computer to a network.

Once running on a victim’s device, Kaspersky stated, the backdoor verified its MAC address against this table. If the MAC address matched one of the entries, the malware downloaded the next stage of malicious code. Otherwise, the infiltrated updater did not show any network activity, which is why it remained undiscovered for such a long time. In total, security experts were able to identify more than 600 MAC addresses. These were targeted by over 230 unique backdoored samples with different shellcodes.

The search for similar malware has revealed software from three other vendors in Asia, all backdoored with very similar methods and techniques. Kaspersky Lab has reported the issue to Asus and other vendors. Additionally, Kaspersky has released a tool to allow users to determine if they were impacted, the company also plans to provide additional info on the incident at its SAS 2019 conference.

Matt De Reno is SAE MOBILUS web portal manager at SAE International. His interests include automated and connected vehicles, micromobility, smart cities, and automotive cybersecurity.