Belajar Red Team Operator - Supply Chain & Third-Party Risk

#Pendahuluan

Setelah di episode 18 kita mempelajari zero trust evasion & testing — policy bypass dan microsegmentation — pada episode ini kita masuk ke supply chain & third-party risk: bagaimana attacker menyerang melalui vendor, dependency, dan trusted relationship.

Supply chain attacks menjadi salah satu vector paling berbahaya di tahun 2026 — SolarWinds, Codecov, dan incident lainnya menunjukkan bahwa keamanan organisasi hanya sekuat supply chain-nya.

#Supply Chain Attack Vectors

#Software Supply Chain

text

Software Supply Chain Attacks
================================
1. Dependency confusion
   → Inject malicious package ke repository
 
2. Compromised developer account
   → Push malicious code ke repository
 
3. Build system compromise
   → Inject malware ke build pipeline
 
4. Update mechanism hijack
   → Compromise software update server
 
5. Open source sabotage
   → Maintain package → inject backdoor

#npm/pip/Maven Attacks

bash

# Dependency confusion demo
# 1. Find private package names (from node_modules, config)
# 2. Publish same name ke public registry dengan higher version
# 3. When target installs → installs attacker's package
 
# Detection: check for private packages in public registry
npm audit
safety check  # Python

#Hardware Supply Chain

text

Hardware Supply Chain
========================
1. Firmware compromise
   → Modify firmware di manufacturing
 
2. Interdiction
   → Intercept shipment, implant device
 
3. Component tampering
   → Replace chip di board
 
4. Counterfeit hardware
   → Fake device dengan backdoor

#Third-Party Risk Assessment

#Vendor Access Testing

text

Third-Party Access Testing
============================
1. Map all vendor access
   - Remote access (VPN, RDP, SSH)
   - Cloud access (console, API)
   - Physical access (maintenance)
 
2. Test vendor credentials
   - Default credentials
   - Shared accounts
   - Excessive permissions
 
3. Test vendor controls
   - MFA requirement
   - Session monitoring
   - Access logging

#Trust Relationship Exploitation

bash

# Compromise vendor → access target
# 1. Phish vendor employee
# 2. Use vendor VPN access ke target
# 3. Pivot ke target internal
 
# Example: managed service provider (MSP)
# Compromise MSP → access all MSP clients

#Supply Chain Red Team

#Emulation Scenarios

yaml

supply_chain_scenarios:
  - scenario: "Compromise npm package"
    technique: "T1195.002 - Supply Chain Compromise: Software"
    steps:
      - "Find internal package names"
      - "Publish malicious package"
      - "Wait for target to install"
      - "Execute payload via package"
    
  - scenario: "Compromise vendor access"
    technique: "T1199 - Trusted Relationship"
    steps:
      - "Identify vendor with target access"
      - "Phish vendor employee"
      - "Use vendor credentials ke target"
      - "Pivot to target systems"

#Detection Evasion

text

Supply Chain Evasion
======================
1. Timing: inject sebelum target installs
2. Naming: use similar names ke legitimate packages
3. Functionality: maintain legitimate function + backdoor
4. Avoid: common security scanning tools

#Supply Chain Security Controls

Control	Description
SCA (Software Composition Analysis)	Scan dependencies for vulnerabilities
SBOM (Software Bill of Materials)	Track all components
Code signing	Verify integrity of updates
Vendor assessment	Regular security reviews
Network segmentation	Limit vendor access

Warning

Supply chain testing membutuhkan izin yang sangat spesifik. Jangan menginjeksi malicious code ke production systems tanpa written authorization. Gunakan lab environment untuk testing.

#Praktik: Supply Chain Lab

bash

# 1. Setup lab: target app + dependency pipeline
# 2. Simulate dependency confusion
# 3. Test: does SCA detect malicious package?
# 4. Simulate vendor compromise
# 5. Test: does vendor access monitoring work?
# 6. Document: gaps in supply chain security

#Penutup

Inti yang harus dibawa pulang:

Software supply chain: dependency confusion, compromised dev account, build system hijack.
Hardware supply chain: firmware compromise, interdiction, component tampering.
Third-party risk: vendor access testing, trust relationship exploitation.
Controls: SCA, SBOM, code signing, vendor assessment.

Di episode 20 selanjutnya, kita akan mempelajari red team legal & compliance — rules of engagement, insurance, dan legal approval untuk engagement.