No one knows, not even the ghosts (人不知,鬼不觉)
-Chinese idiom
It’s perhaps only a coincidence that there’s a famous Chinese saying that neatly summarizes a recent hack on MiMi, a Chinese messaging app. According to recent reports, a Chinese state-backed hacking group inserted malicious code into this messaging app, essentially pulling off the equivalent of the infamous SolarWinds hack. Users of MiMi were served a version of the app with malicious code added, thanks to attackers taking control of the servers that delivered the app. In short, this was a software supply chain attack in which the software delivery pipeline was compromised.
And no one knew for months.
This hack hasn’t gotten much press in Western media, potentially because this appears to be an example of Chinese state surveillance on targets that aren’t in the United States or Europe. That’s a shame because this attack points to a growing trend of software supply chain attacks, even by the Chinese government. Consequently, Western companies and governments should take note and begin preparing defenses.
Admittedly, not all of the details are known (or will ever be known), but forensic code analysis indicates that a particular Chinese state-backed hacking group (sometimes called Lucky Mouse or Iron Tiger) likely took control of servers that allowed users to download the MiMi Chinese chat application, which is aimed at Chinese-speaking users. The hackers then switched out the original software with a malicious version, adding code into the application that fetched and installed malware.
At that point, the malware, unknown to the user, allowed the attackers to monitor and control the software remotely. This appears to have happened in late 2021 and through the summer of 2022. Interestingly, neither the legitimate application nor the malware were digitally signed, which meant that users had no way of knowing that this software was malicious.
Observers could be forgiven for thinking that this is just another hack. Chinese hacking groups, and those of Western countries too, have developed a reputation over the past two decades for spying, surveillance, and sabotage. But this attack is different than typical hacking fare because the attackers rode in on the back of a trusted piece of software. This is a software supply chain attack, where the attackers tamper with either source code, the software build system, or the software publishing pipeline, all of which have become essential to the functioning of the world’s digital economy.
According to our own estimates, software supply chain attacks have been rapidly growing in frequency. Twenty years ago, there might have been one or two a year. These days, depending on the methodology, there are either hundreds or thousands a year, and that’s only counting the reported attacks. And increasingly anybody who depends upon software (read: everybody) is or shortly will be a victim: the U.S. government, Microsoft, thousands of other companies and, apparently in this MiMi attack, individuals.
If these software supply chain attacks only originated from criminal gangs, then world leaders might be able to sleep better at night. But that a Chinese state-backed hacking group is perpetrating software supply chain attacks means that prudent leaders need to see this trend as part of statecraft and not simply cybercrime. This trend threatens the free flow of cross-border digital trade and promises to increase the costs of software acquisition as buyers increasingly scrutinize purchases from “untrusted” sellers.
Fortunately, the world’s software supply chain doesn’t have to be held hostage by attackers. There are methods for ensuring the integrity of the software supply chain, but they are currently not deployed widely, leaving a hole for attackers.
Perhaps most directly, digital signatures on software can go a long way toward restoring trust in the software supply chain. The normal MiMi app was unsigned; so was the malicious version. Consequently, users had no way of verifying that this software hadn’t been tampered with somewhere in transit. The Sigstore project aims to change this, providing developers and software consumers a friendly way to sign software and verify that their software has not been tampered with.
Other approaches like TUF, The Update Framework, can also help software update systems avoid compromise. This way, the typical software user can continue to trust the updates that constantly flow over the internet into their connected devices.
These days, when a software supply chain attack occurs, especially when otherwise good apps are hijacked and turned into vectors of malware, it’s fair to say that no one knows, not even the ghosts. But the world’s software doesn’t need to be like this. Defenses like digital signatures can help ensure the integrity of the software supply chain. This way, in the future, should MiMi or any other application be hacked, everyone would know, and the only secret is why society ever let it be otherwise.