In this presentation, the speaker adopts a hypothetical "evil Matthew" persona to illustrate how a nation‑state hacker might plan and execute supply‑chain attacks in the wake of the SolarWinds breach. He outlines three strategic approaches: first, exploiting organizations that remain vulnerable to known SolarWinds exploits; second, piggybacking on software already compromised by other nation‑states to avoid the heavy lifting of a fresh intrusion; and third, launching a dedicated, resource‑intensive supply‑chain campaign targeting high‑value vendors. The speaker then identifies five critical sectors that would provide the greatest leverage if compromised: IT management and monitoring tools, cybersecurity vendors, operating systems (including network, IoT, and virtual machine layers), hardware and firmware, and cloud service providers. Concluding, he stresses that defensive practices must evolve rapidly to match attacker innovation, warning that relying on past attack models leaves organizations exposed to the next wave of supply‑chain threats.
Chapters
Cyber threats are racing to find and exploit the next big supply chain hack. Supply chain attacks like that of SolarWinds are tectonic shifting in the cybersecurity world. In its wake, the industry is still struggling to grasp the potential ramifications. Well, everybody except the attackers themselves. They see it as the next step in their evolution and are moving as fast as they can to jockey for a good position. Now let me turn this around for a moment and show it from the other side. Imagine, if you will, I were evil Matthew with grandiose diabolical plans of world domination, or perhaps just running a nation-state offensive team. How would I maneuver for an advantage, and where would I attack? Well, first I would attack those who remain vulnerable to the SolarWinds exploits. Those who haven't patched or shut off those IT tools, they make for easy targets. You know, lazy security is an attacker's friend. So I'd go after them first. They're easy, low-hanging fruit. Second, well, I would find another piece of software that has been compromised by another nation-state and piggyback on their work. Basically, I would slipstream into what is already compromised because sadly, SolarWinds most likely is not the only piece of software out there that was compromised. There are other ones from other nation-states that are probably just as undermined. We just don't know it yet. And so, you know, being in a leadership position, why would I expend all those resources and do the heavy lifting when another nation-state has probably already done it for me? I just have to find it and compromise that, go into those same doors, and that makes it a whole lot easier for me. Now, third, and this is the most difficult, Well, I would have to start from scratch and begin a supply chain attack campaign that targets specific vendors that would give me the desired access and control of valuable global capabilities like government systems and services, national defense systems, national critical infrastructure like power, water, sanitation, uh, food distribution, logistics. Things like that. And I would also want to target capabilities that would give me access to highly valuable assets of major businesses. All right, now this is probably the toughest and most resource-intensive, but it's a very powerful path if successful, and SolarWinds shows that it is absolutely possible. Okay, now for this option, who would I explore for compromise? Well, I've got 5 sectors that I would actually go after. And this first one is, well, it's no surprise, it's the IT management and oversight tools, just like SolarWinds. But I would be looking for tools and companies that do the monitoring, right, the IT monitoring or provisioning of systems, configuration, and the administration of systems. That would give me the right level of access that I would be able to succeed. So that would be my first one. My second one would be cybersecurity vendors, um, security products, tools, services. Well, those are the capabilities that we trust, and being able to compromise them Well, those are also the ones that are looking for other bad actors in the form of software services or attackers. If you can compromise that, well, you're gonna be able to hide from it, obviously. So it gives you great access. You have built-in trust to do things, and you're gonna be able to hide because you control, you are the watcher. Now, the third area is around operating systems. And I'm not talking just server and desktop, because that's important, but network operating systems, IoT, and I would also include virtual machines and virtual machine managers in this, because when we look at the stack and we have applications up here, beneath them are the operating systems. So if you can undermine those, you're at or below where the security tools are operating, and if you're below them, they can't see you. So tremendous amount of power, and it's— you're gonna have a much better capability of staying undetected, remaining stealthy. And if we continue on that stack, well, what's beneath the operating system but hardware and firmware? So I would target those type of developers. Again, it's more difficult, but it's further down the stack. You get more power. It's really tough to evict an attacker out of that space. And being detected, well, good luck, because again, you are now well below the security and the monitoring tools and even the operating systems that might be able to detect things like that. The last area, well, it's cloud. Everybody's going to cloud. You have tremendous dependencies out there and cloud services they have multiple tenants on the same hardware and network, um, using the same administrative tools. So this is a great centralized point, and again, very, very difficult. And cloud service providers know that they're being targeted, so they're trying to actively protect it. But if you can compromise a major cloud service, it's game over because you have access to all the customers data, right? Their storage, their, their information processing. And these cloud systems are trusted back by the local environment of those companies. And you just, you have access to key business and services and everything that's important. So these are the choicest targets of evil Matthew that give tremendous access, allow for extended stealthy persistence and are difficult to evict once detected. These are the domains that I am most concerned with that nation-states are targeting. And as I've said before, cybersecurity must grow and evolve at the pace of attacker innovation. The SolarWinds attack is the prima facie evidence that a new set of security disciplines and capabilities are needed to address supply chain attacks. Cyber threats are evolving quickly. We cannot afford to only consider yesterday's attacks. We must look ahead to the next maneuver of our enemy if we want to interdict, or at the very least minimize the damage.
