Post

Jimmy Wylie
@mayahustle.com

A lot of folks have reached out about Socket’s recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs. This is not a supply chain attack in the traditional sense. 1/6

2 reposts3 likes

Jimmy Wylie
@mayahustle.com

No legitimate projects were compromised, and no S7, Sharp7, or Siemens codebases were modified. Socket identified packages published by a separate user ("shanhai666") containing code that probabilistically kills host processes and causes database write failures within specific date ranges. 2/6

Jimmy Wylie
@mayahustle.com

While I agree the code is harmful and the packages are suspicious, I'm not convinced about the supply chain attack angle -- or if it is one, it’s not a particularly effective one. Several factors give me pause: 3/6

Jimmy Wylie
@mayahustle.com

- The lure isn't convincing. - The packages are unpopular (even by Socket's metrics), so infection of new projects seems improbable. - Why would existing projects switch to the malicious dependencies? - There's no C2 code to confirm victims. How would an attacker know if this worked? 4/6

Jimmy Wylie
@mayahustle.com

The evidence also doesn't rule out security research as an explanation. I’d give this a low confidence assessment for malicious intent. That said, it's normal for analysts to reach different conclusions, and this isn't a criticism of Socket's solid technical analysis. 5/6