The IT Nerd

Applied Materials is saying that a breach at one of its suppliers would cost them $250 million in sales in the second quarter:

In the second quarter of fiscal 2023, Applied expects net sales to be approximately $6.40 billion, plus or minus $400 million, which includes ongoing supply chain challenges and a negative estimated impact of $250 million dollars related to a cybersecurity event recently announced by one of our suppliers. Non-GAAP adjusted diluted EPS is expected to be in the range of $1.66 to $2.02.

A clue was dropped in the earnings call:

“Very recently, one of our major suppliers encountered a disruption that will impact our second-quarter shipments,”

Though not named in the announcement, the supplier is believed to be MKS instruments of Andover MA. MKS instruments was hit by a cyber-attack on February 3^rd. The attack caused the company to shut down operations at certain facilities while it tries to assess the damages. The company’s website was still down as of Thursday afternoon. The company has had to reschedule its fourth quarter earnings call and said the ransomware event had a material impact on its “ability to process orders, ship products and provide service to customers” in its vacuum and photonics divisions.

Here’s the connection between the two. In addition to Applied Materials, MKS supplies the world’s largest chip manufacturers with products, including Samsung Electronics and Taiwan semiconductor manufacturing the world’s two largest chip makers. Intel and ASML Holding NV are also customers. Meaning that this is very, very bad for a whole lot of people.

Ted Miracco, CEO, Approov:

   “The semiconductor supply chain remains one of the most complicated and most critical supply chains that underpin the entire global economy. As we witnessed last year, interruptions in the semiconductor market can have long term consequences that impact everything from automobiles to the price of food. 

   “With the ongoing “Chip War” between the US and China, we should expect more disruptions like this in the future, and quarterly earnings should be the least of our concerns. These attacks on the semiconductor supply chain deserve a lot more attention than the latest balloon incidents.”

Monti Knode, Director of Customer Success, Horizon3.ai:   

   “It’s interesting that MKS called out “had a material impact”, almost like they had to announce and clarify that a cyberspace attack could and did have a tangible outcome. We’re seeing this realization more in both public and private industry, especially in our Department of Defense which viewed as cross-domain operations; Russia has been doing this for years, and now the world is seeing it live in Ukraine and even here in the US (ref https://www.mirror.co.uk/news/us-news/breaking-russian-hackers-target-hospitals-29053567).

   “The days of presuming this to be an IT or cybersecurity problem are long gone.”

This is a clear example of what a supply chain attack can do to you if you and your partners aren’t careful. Thus you and those you work with have to make sure you’re on the same page from a cybersecurity standpoint. Otherwise, this is the sort of thing that can happen to you.

Hackers are using fake code-signing certificates impersonating cybersecurity firm Emsisoft to target customers using its security products, hoping to bypass their defenses:

We recently observed an incident in which a fake code-signing certificate supposedly belonging to Emsisoft was used in an attempt to obfuscate a targeted attack against one of our customers. The organization in question used our products and the attacker’s aim was to get that organization to allow an application the threat actor installed and intended to use by making its detection appear to be a false-positive.

The attack failed – our product detected and blocked it – but we are issuing this alert so that both our customers and users of other company’s products are aware of the tactics that were used in this case. 

Kevin Bocek, VP Ecosystem and Community at Venafi had this to say:

“Spoofing has been an issue for companies for a long time, but more commonly associated with website spoofing linked to phishing – so it’s interesting that the same ‘change one letter’ approach is being applied to code signing machine identities. The fact that we’re seeing threat actors impersonating companies with fake code-signing certificates is a sign of the times, as we are increasingly seeing threat actors targeting machine identities, due to the level of trust they have within the network. Threat actors understand that being granted trusted access to a company’s system via fake machine identities is akin to being ushered through the digital front door. In this instance the spoofed identity was detected and flagged, but it could easily have been overlooked.

“The continued adoption of cloud native technologies is creating huge levels of complexity around machine identity management, it’s harder than ever for teams to make decisions on what can and can’t be trusted to run – especially given the speed of development environments. With the number of machine identities across an organization growing exponentially, organizations need a control plane to automate the management of machine identities. This provides teams with the observability, consistency and reliability needed to effectively manage their machine identities and spot any bad actors from trying to spoof their way in.”

This is yet another thing for you to keep your eyes out for as the attack surface that threat actors use is clearly evolving.