SC-101: Firmware Supply Chain Compromise -- Operation SILICON GHOST¶

# Simulated supply chain compromise (educational only)
# Attacker targets firmware manufacturer's build pipeline

# Step 1: Compromise code review contractor
# Target: CodeAudit Partners (codeaudit-partners.example.com)
# A small firm providing code review services to NetForge
# Contractor VPN credentials obtained via spearphishing:
#   testuser@codeaudit-partners.example.com / REDACTED

# Step 2: Pivot from contractor VPN to NetForge dev network
# Contractor VPN provides access to:
#   10.100.20.0/24 -- NetForge code review environment
#   Source code repositories (GitLab) at git.netforge-systems.example.com
#   Build system (Jenkins) at build.netforge-systems.example.com

# Step 3: Compromise NetForge Jenkins build server
# Jenkins version 2.401.2 with outdated plugins
# Plugin: Script Security 1254.v3f79f5965cb_8 (CVE in sandbox bypass)
# Attacker creates malicious Groovy script in pipeline:

# Modified Jenkinsfile for NF-9000 firmware (synthetic):
pipeline {
    agent { label 'firmware-builder' }
    stages {
        stage('Build') {
            steps {
                sh './build_firmware.sh --target nf9000 --release'
            }
        }
        stage('Post-Build') {
            steps {
                // INJECTED BY ATTACKER: Patch firmware binary post-build
                sh '''
                    python3 /tmp/.fw_patch.py \
                        --input build/nf9000-fw-v12.4.3.bin \
                        --implant /tmp/.silicon_ghost.ko \
                        --output build/nf9000-fw-v12.4.3.bin
                '''
            }
        }
        stage('Sign') {
            steps {
                // Firmware is signed AFTER implant injection
                // So the signature is valid for the backdoored image
                sh './sign_firmware.sh --key /keys/nf9000-release.key'
            }
        }
    }
}

# Step 4: Deploy implant module to build server
# The .silicon_ghost.ko kernel module:
#   - Hooks network stack at the netfilter layer
#   - Mirrors selected traffic to C2 via covert DNS channel
#   - Provides remote shell access via crafted ICMP packets
#   - Survives firmware reset (stored in protected flash region)
#   - Process name: 'nf_conntrackd' (mimics legitimate daemon)

# Step 5: Backdoored firmware enters release pipeline
# NF-9000 firmware v12.4.3 -- released 2026-02-15
# NF-5000 firmware v8.2.1 -- released 2026-02-22
# SHA-256 checksums generated AFTER backdoor insertion
# GPG signatures valid (signed after modification)
# All checksums on updates.netforge-systems.example.com match

# SPL -- Detect anomalous build server activity
index=devops sourcetype=jenkins:build earliest=-90d
| search (process_name="python3" OR process_name="bash")
    AND (command_line="*fw_patch*" OR command_line="*implant*"
         OR command_line="*.ko*")
| table _time, host, process_name, command_line, parent_process
| sort -_time

# Simulated firmware deployment (educational only)
# MFS deploys backdoored firmware through normal processes

# Step 1: MFS NOC team downloads firmware update
# Network Engineer (testuser@meridian-federal.example.com)
# logs into updates.netforge-systems.example.com
# Downloads NF-9000 v12.4.3 and NF-5000 v8.2.1

# Step 2: Standard validation (ALL PASS -- backdoor is pre-signature)
$ sha256sum nf9000-fw-v12.4.3.bin
a3f7d8e2c1b4... nf9000-fw-v12.4.3.bin  # MATCHES published hash
$ gpg --verify nf9000-fw-v12.4.3.bin.sig nf9000-fw-v12.4.3.bin
gpg: Good signature from "NetForge Release Signing Key"

# Step 3: Lab testing (functionality passes)
# Test router NF9K-LAB-01 (10.50.99.10) updated to v12.4.3
# All functional tests pass:
#   - Routing protocols (OSPF, BGP): PASS
#   - ACL enforcement: PASS
#   - Performance benchmarks: PASS (within 2% of previous)
#   - Management interface: PASS
# Note: Backdoor does not activate during first 72 hours
# to avoid detection during testing windows

# Step 4: Change management approval
# Change Request: CHG-2026-0847
# Category: Standard Change (firmware update)
# Risk Level: Low (vendor-signed, lab-tested)
# Approval: Auto-approved per standard change policy
# Maintenance Window: 2026-03-15 02:00-06:00 UTC

# Step 5: Production deployment
# Phase 1 (Night 1): Core routers -- 48 devices
#   NF9K-CORE-01 through NF9K-CORE-12 (10.50.10.1-12)
#   NF5K-DIST-01 through NF5K-DIST-36 (10.50.20.1-36)
# Phase 2 (Night 2): Access layer -- 140 devices
# Phase 3 (Night 3): Branch offices -- 95 devices
# Phase 4 (Night 4): Remaining devices -- 57 devices
# Total: 340 devices updated over 4 nights

# Step 6: Backdoor activation (72 hours after each phase)
# Phase 1 devices activate: 2026-03-18 02:00 UTC
# Backdoor 'nf_conntrackd' process starts on each device
# Initial beacon via DNS TXT queries:
#   TXT query: <encoded_device_id>.status.netforge-cdn.example.com
#   Response: TXT "v=spf1 <encoded_c2_instructions>"
# Beacon interval: every 3600 seconds (1 hour)
# C2 channel: DNS over port 53 to 203.0.113.40

# SPL -- Detect periodic DNS TXT beaconing from network devices
index=dns sourcetype=dns earliest=-30d
| search query_type=TXT query="*.netforge-cdn.example.com"
| bucket _time span=1h
| stats count as beacon_count, dc(src_ip) as unique_devices,
        earliest(_time) as first_seen, latest(_time) as last_seen
        by _time
| where beacon_count > 10
| table _time, beacon_count, unique_devices, first_seen, last_seen

# Simulated UEFI implant propagation (educational only)
# Compromised network devices infect management workstations

# Step 1: Identify management workstations via SSH sessions
# Backdoored devices log all incoming SSH management sessions:
# Source IPs in management subnet 10.50.1.0/24
# Identified 85 unique management workstations over 30 days

# Step 2: UEFI implant delivery mechanism
# When a management workstation connects via SSH to a
# compromised device, the device:
# 1. Identifies the connecting workstation's OS via SSH banner
# 2. Exploits a vulnerability in the SSH client's terminal
#    emulation (crafted escape sequences trigger buffer overflow)
# 3. Downloads UEFI implant via the management network
# 4. Installs implant in SPI flash (UEFI firmware region)

# UEFI implant characteristics (synthetic):
# Name: silicon_ghost_uefi.efi
# Location: SPI flash, EFI System Partition (hidden volume)
# Size: 128 KB (embedded in unused firmware padding region)
# Persistence: Survives OS reinstall, disk replacement, firmware update
# Capabilities:
#   - Pre-OS keylogger (captures full disk encryption passwords)
#   - Network stack hook (mirrors selected traffic pre-encryption)
#   - Injects DLL into OS kernel during boot (ring-0 access)
#   - Anti-forensics: Does not appear in standard UEFI variable list
#   - TPM bypass: Replays known-good PCR measurements

# Step 3: Implant activation on workstations
# 85 NOC workstations compromised over 30-day window:
#   NOC-WS-001 through NOC-WS-045 (10.50.1.101-145)  -- Primary NOC
#   NOC-WS-046 through NOC-WS-070 (10.50.2.101-125)  -- Branch NOCs
#   NOC-WS-071 through NOC-WS-085 (10.50.3.101-115)  -- Remote admins

# Implant beacon (separate from router backdoor):
# Protocol: HTTPS POST to firmware-analytics.example.com/api/telemetry
# User-Agent: NF-UpdateManager/3.2.1 (mimics legitimate update check)
# Beacon interval: 14400 seconds (4 hours)
# Payload: Encrypted hardware inventory, keystrokes, screenshots

# Step 4: Credential harvesting from management workstations
# UEFI pre-boot keylogger captures:
#   - BitLocker PINs for encrypted workstation drives
#   - SSH private key passphrases
#   - VPN credentials for remote management
#   - Console passwords for classified enclave equipment
# All captured credentials exfiltrated via HTTPS beacon

# SPL -- Detect TPM and firmware attestation anomalies
index=endpoint sourcetype=windows:security earliest=-90d
| search (EventCode=6400 OR EventCode=6401)
    OR (signature="Firmware" AND action="modified")
| stats count as anomaly_count, dc(host) as affected_hosts,
        values(host) as hosts by EventCode, signature
| where anomaly_count > 3
| table EventCode, signature, anomaly_count, affected_hosts, hosts

# SPL -- Detect suspicious HTTPS beaconing mimicking update manager
index=proxy sourcetype=proxy earliest=-90d
| search url="*firmware-analytics.example.com*"
    OR user_agent="NF-UpdateManager*"
| bucket _time span=4h
| stats count as requests, dc(src_ip) as unique_sources,
        values(src_ip) as sources by _time
| where requests > 5 AND unique_sources > 3
| table _time, requests, unique_sources, sources

# Simulated intelligence collection (educational only)
# Attacker harvests network architecture intelligence

# Collection Target 1: Routing tables and network topology
# Every compromised router exports its routing table weekly:
#   - OSPF link-state database (full internal topology)
#   - BGP routing tables (external connectivity)
#   - ARP tables (host-to-IP mapping)
#   - Interface configurations (VLAN assignments, ACLs)
#   - VPN tunnel configurations (site-to-site connections)

# Example exfiltrated data (synthetic):
# Router NF9K-CORE-01 (10.50.10.1) -- OSPF database excerpt:
#   Area 0.0.0.0: 48 router LSAs, 36 network LSAs
#   Area 0.0.0.1 (classified): 12 router LSAs, 8 network LSAs
#   Stub area 0.0.0.200: 6 router LSAs (classified enclave)
#   External LSAs: 24 (BGP redistributed routes)

# Collection Target 2: Traffic flow metadata
# Compromised switches mirror NetFlow data to C2:
#   - Source/destination IPs and ports
#   - Protocol information
#   - Byte counts and timing
#   - NOT full packet capture (bandwidth limitation)
#   Exported via DNS TXT queries: ~500 bytes per query
#   Rate: 100 queries/hour per device (below detection threshold)

# Collection Target 3: Management credentials
# From UEFI-compromised workstations:
#   - 340 router/switch local admin credentials
#   - 12 TACACS+ server credentials
#   - 6 RADIUS shared secrets
#   - 45 SSH key pairs for device management
#   - 3 console passwords for classified enclave boundary devices
#   All exfiltrated: testuser/REDACTED format

# Collection Target 4: Classified enclave boundary information
# The classified enclave (10.200.0.0/16) is air-gapped
# BUT management workstations in the NOC manage BOTH networks
# (separate physical interfaces, but same workstation)
# UEFI implant captures keystrokes on both interfaces
# Intelligence value: classified network topology, device configs,
# access procedures, and cross-domain transfer mechanisms

# Exfiltration summary over 18 months:
#   Total data exfiltrated: 4.2 GB (compressed)
#   Network topology maps: Complete for all 6 facilities
#   Routing configurations: 340 device configs (weekly updates)
#   Credential sets: 406 unique credential pairs
#   Traffic metadata: 18 months of flow data
#   Classified boundary info: Partial topology of air-gapped network

# SPL -- Detect DNS exfiltration from management network
index=dns sourcetype=dns earliest=-30d
| search src_ip="10.50.*" query_type=TXT
| eval query_length = len(query)
| where query_length > 60
| bucket _time span=1h
| stats count as total_queries, avg(query_length) as avg_length,
        dc(query) as unique_subdomains, dc(src_ip) as source_devices
        by _time
| where total_queries > 50 AND avg_length > 80
| table _time, total_queries, avg_length, unique_subdomains, source_devices

# Simulated discovery and response (educational only)
# Hardware attestation audit reveals compromise

# Step 1: Discovery trigger
# MFS deploys new firmware integrity monitoring tool as
# part of CMMC Level 3 compliance preparation
# Tool compares runtime firmware hash against vendor-published
# "known-good" baseline (not the compromised checksum)
# NetForge releases a firmware integrity tool that uses
# hardware root of trust rather than software checksums

# Hardware attestation results:
$ nf-integrity-check --device 10.50.10.1 --baseline hardware-rot
Device: NF9K-CORE-01 (10.50.10.1)
Firmware Version: 12.4.3
Software Hash: a3f7d8e2c1b4... [MATCH - published hash]
Hardware RoT Hash: MISMATCH
  Expected: 7f2a9b3c...
  Actual:   e4d1c8a7...
  Delta: 128KB in offset 0x7F0000-0x80FFFF
Status: FIRMWARE INTEGRITY VIOLATION

# 340 of 340 devices show the same firmware mismatch
# Alert escalated to MFS CISO at 2027-09-15 14:30 UTC

# Step 2: Initial response (IR Team activation)
[2027-09-15 15:00 UTC] Incident declared: CRITICAL
[2027-09-15 15:30 UTC] DFARS 252.204-7012 notification initiated (72 hours)
[2027-09-15 16:00 UTC] NetForge Systems contacted -- vendor confirms
    their build server was compromised in January 2026
    (they discovered it independently 2 weeks prior)
[2027-09-15 17:00 UTC] FBI Cyber Division and CISA notified
[2027-09-15 18:00 UTC] All NetForge devices placed in monitoring-only mode
    Traffic rerouted through backup Cisco infrastructure

# Step 3: UEFI implant discovery
# During workstation forensics, team discovers UEFI anomalies:
$ chipsec_util.py spi dump spi_dump.bin
$ python3 uefi_analyzer.py --image spi_dump.bin --baseline clean_image.bin
[!] ALERT: Unknown EFI module detected in SPI flash
    Module: silicon_ghost_uefi.efi (128 KB)
    Location: Padding region at offset 0x1F0000
    Signature: NOT in UEFI whitelist
    Capabilities: DXE driver, runtime services hook
    Status: ACTIVE -- hooking ExitBootServices

# 85 of 85 management workstations contain UEFI implant

# Step 4: Full scope assessment
[2027-09-16] Network forensics reveals:
  - 18 months of DNS exfiltration (4.2 GB total)
  - 340 network devices compromised
  - 85 management workstations with UEFI implants
  - Classified enclave boundary information compromised
  - All network credentials must be considered compromised
  - Full network topology exposed to threat actor

# Step 5: Remediation (extremely costly)
# Network devices: Complete hardware replacement required
#   - Cannot trust firmware even after reflash (compromised flash regions)
#   - 340 devices replaced with Cisco alternatives: $12M
# Workstations: Complete hardware replacement required
#   - UEFI implants cannot be removed by software
#   - 85 workstations replaced: $425K
# Network redesign: New topology required (old one compromised)
#   - Full re-architecture of all 6 facilities: $15M
# Credential rotation: All 406 credential sets rotated
# Classified enclave: Full security assessment required
#   - NSA/CSS involvement for classified systems review
# Vendor management: NetForge contract terminated
# Total estimated cost: $95M over 3 years

# SPL -- Detect widespread firmware integrity failures
index=endpoint sourcetype=firmware_audit earliest=-7d
| search integrity_status="FAILED"
| stats dc(device_name) as failed_devices,
        values(device_name) as device_list,
        earliest(_time) as first_detected,
        latest(_time) as last_detected
        by date_mday
| where failed_devices > 5
| table date_mday, failed_devices, device_list,
        first_detected, last_detected