Attack Vectors for Supply Chain Sabotage

Question

There's two opposing forces acting against each other in a covert intelligence war.

The names here are substituted to protect myself.

The United States of Eagle - High technology, overtly bound by ethics and reportability
The Confederation of Crow - Mediocre technology level (think of your generic African or Middle East aggressor state as part of your generic 80's/90's pulp spy movie/book).

The intelligence agency of the USE has managed to infiltrate the part of supply chain of the CoC that supplies the defence and intelligence agencies.

This part of the supply chain supplies basic office supplies, including, but not limited to:

• Paper
• Printer Toners
• Keyboards/Mice
• Mouse mats
• Ring binders
• Pens/Pencils
• Whiteboards
• Desktop calculators
• Desk fans
• Consumer level batteries

The USE intelligence service does not yet have access to the disposal side of the supply chain.

The CoC performs basic checks on incoming goods, checking for explosives and electronics where there shouldn't be. Bear in mind that the CoC are intelligent enough to change suppliers if their computer mice keep exploding...

Given access to tamper with the types of products listed before deliver to the CoC intelligence/defence installations, what attack vectors can be used? What damage could be caused, and potentially how could intelligence be gathered (assuming the agents of USE cannot get within radio distance if the installations)?

Setting: Modern day. USE Technology: Believable, with spatterings of handwavium.

Answer 1

Here is a bit whimsical method to mess with the bad guys. Take a page from the Joker in the 1989 Batman film. Use a 2 part toxin in the pens, toner, and paper!

Bureaucracies mean paperwork, and lots of it. If printed sheets off gas something that is mildly toxic, not necessarily lethal or dramatic, you could create all kinds of bureaucratic snafus. Get the workers slightly high all the time and you run a good chance of really screwing things up even for the most brilliant of generals. Examination of the office supplies might not happen immediately and it would be slowed down even more by the 2 part nature of the toxin.

There is a theory among students of history about how events may have been affected by drugs. For example, it is surmised that Napoleon got a non lethal dosing of Laudanum just prior to the battle of Waterloo, messing with his judgement and costing him the war.

It's not a long term strategy for a major win, but it is something to help things along, and even if found out, to inspire even greater paranoia in the CoC.

Answer 2

By misdirecting shipments so that e.g. one base gets 200 tons of paper, but one doesn't, thus requiring extra effort to redress the bureaucratic screw-ups. This wouldn't require any technology at all - just an "incompetent" pen-pusher in the right office.

If you want a technological attack, something along the lines of firmware attacks (e.g. BadUSB) on mice/keyboards would help. Something like:

• Keyloggers inside an keyboard
• Capacitors with a large enough charge to fry the computer
• Malware (something like Stuxnet)

If enough of these occur or are spotted, the COC will start adding extra security checks to try and catch these, which will result in things slowing down (if you can't do your job because of Super Critical Security checks...then anyone who's depending on your work is going to be delayed).

Answer 3

Tempering electronics would be my choice.

Depending on the technological level difference between the two states, I would assume adding electronics to existing electronic devices would be best.

• Add a hardware keyboard logger to the keyboard.
• Add a microphone to the desk fan

The CoC may perform basic checks but unless they do a comparison between the layout and the schematics, the personal won't ask about every die on the PCB.

---

What's giving me a headache is:

assuming the agents of USE cannot get within radio distance of the installations

USA... USE agents must at least have gained access to some communications provider to transfer the intelligence to the outside world.

Answer 4

New Answer

Access to keyboards are still instant win buttons

Like the old answer, compromised keyboards are prime targets to hacking because so much sensitive information passes through them. Mice are probably a good thing to compromise but I don't know how much they add.

Attack Environment

It's very common for high security computer networks to be protected by what's known as an 'air wall' or 'air gap'. These are designed to drastically increase the difficulty when exfiltrating data from a secured computer/network. Combined with the inaccessibility of the target locations by radio, this raises an interesting problem...which requires interesting solutions.

Occasionally, high security computers will be put in close physical proximity to low security computers that have (direct or indirect) access to the internet. The air gap still exists between those two computers, so we need someway to jump the gap.

Jumping the Gap

Using the USB cable tampering technique described below, in the keyboard include an SoC that is capable of driving the USB antenna (I mean, EMI shroud) as a transmitter or receiver.

Each SoC will be capable of the following:

• Detecting whether this computer is capable of connecting to the broader Internet
• Driving the radio receiver
• Driving the radio transmitter
• Storing key presses and mouse strokes for later transmission.

If a keyboard detects that it can connect through the PC to the Internet, it will put itself in receiver mode and begin to store the transmissions from nearby keyboards. Else, the keyboard will put itself into transmit mode and start broadcasting all keystrokes. A small amount of overcurrent may be required to get acceptable transmit ranges. As with the old answer, a fingerprint should be added to each keyboard to ensure that keystroke streams can be properly analyzed.

As time goes by, the receiver keyboards will collect keystroke streams from the transmitting keyboards. Possibly, using a virtual USB network device built into the SoC, the keyboard can upload data to the appropriate network. Care must be taken to ensure that these transmissions don't look like exfiltration traffic. Perhaps a few bytes an hour on well-known service ports? You'll have to contend with firewalls, blocked ports and a host of other network defense measures. That SoC plays a huge role in getting out the required data.

---

Old Answer

Access to keyboards and mice are instant win buttons

All of the other office supplies are yeah, kind of useful, for espionage (I can think of ways to track internal supply chains by doping printer toner with "fingerprint" chemicals). BUT! Keyboards and mice are super win. Every password is typed on a keyboard. Every secret letter is typed on a keyboard.

Exfiltration

Putting micro storage devices in to keyboards and mice doesn't make a ton of sense since USE can't reliably recover devices at disposal. Even if they could be recovered, keyboards and mice can stay in service for many years. With perfect storage these devices would contain data from a "long long time ago" which would be of decreased value compared to data of "this happened five minutes ago". Further, let's assume that CoC is super paranoid and destroys all electronic devices on retirement. (Doing so would be really good operational security. I'd be surprised if they didn't do this.)

USE should do the following to selection of keyboards: Leave the USB cable shield floating and add a 'fingerprint' to each keyboard.

Interesting. However, I think that the shield (cable braid and plug/socket shell) must be connected to ground on at least one end. If the shield were left floating, then other signals would be able to couple to it and use the shield as a nice long antenna to radiate EMI. (source)

The 'fingerprint' for each keyboard ensures that USE spies can differentiate between affected keyboards. It'd be a shame to have five spying keyboards but the data isn't useful because you can't tell one keyboard from another.

Need more range? Embed a radio-reflective layer of metal into the whiteboards and build in an ever so slight concave curve with a focal length of several hundred meters. To gather these reflected signals, station a listen post at the focus of the whiteboard.

You've basically turned affected keyboards into miniature radio towers. I'm not an electrical engineer so I can't tell you the range of transmission but any range of transmission is an exploitable property. Combine this with some kind of recording device that listens for data from these keyboards and you've got a first rate espionage tool.

Benefits

The benefit of this approach is that if detected, it is merely a manufacturing defect in the keyboard, not an overt attempt at espionage. Care must be taken to ship 'defective' keyboards at or below the typical failure rate for keyboards (I wasn't able to find a source for what the defect rate is.) Stuxnet survived for a very long time because it didn't do anything beyond making centrifuges wear out faster.

This attack also doesn't rely on the Internet to get data out.

Limitations

You can't control where the keyboards are deployed so you may end up with some less than useful placements. You're unlikely to get a juicy stream from the Supreme High Leader of the People's Republic personal machine. However, you are likely to get intel from his secretary. Remember, secretaries know everything.

Damage Dealt

Keylogging attacks reveal passwords, usernames, meeting agendas, private notes to colleagues, internal dissent (if any), operating procedures, power hierarchies, office politics, (after analysis) possible recruits.

No handwavium required. All proposals for espionage with these tools can be accomplished with 2017 level tech.

Answer 5

Conveniently, the CIA recently declassified a manual with instructions and suggestions for sabotage. It's short and simply written, and you should read it.

The manual describes a few different considerations. The big ones I remember are distinctions between actions when the armed forces are mobilized or not, distinctions between skilled and unskilled saboteurs, and a focus on making sabotage more than just malicious mischief.

It also speaks to the effectiveness of slowdowns, even without physical damage. This got into the news around 2010, so it may look familiar:

Here’s a list of five particularly timeless tips from the Simple Sabotage Field Manual:

Managers and Supervisors: To lower morale and production, be pleasant to inefficient workers; give them undeserved promotions. Discriminate against efficient workers; complain unjustly about their work.

Employees: Work slowly. Think of ways to increase the number of movements needed to do your job: use a light hammer instead of a heavy one; try to make a small wrench do instead of a big one.

Organizations and Conferences: When possible, refer all matters to committees, for "further study and consideration." Attempt to make the committees as large and bureaucratic as possible. Hold conferences when there is more critical work to be done.

Telephone: At office, hotel and local telephone switchboards, delay putting calls through, give out wrong numbers, cut people off “accidentally,” or forget to disconnect them so that the line cannot be used again.

Transportation: Make train travel as inconvenient as possible for enemy personnel. Issue two tickets for the same seat on a train in order to set up an “interesting” argument.

In general, you also want your sabotages to have follow-on effects. So, if you blow up a jeep, that jeep is gone. If you introduce sugar to some but not all fuel cans at a depot, you will take out several jeeps, and incur the costs to do a full inspection of the fuel supply.

Answer 6

Tag office supplies for the CoC foreign intelligence service with something that shows up under forensic identification methods like DNA marking.

When somebody shows up on your borders with a high concentration of those tags, that person gets close attention as a likely spy. (Don't stop them, follow them instead.) Someone with a low concentration may be a contact of a spy, perhaps a family member, and become a target for compromising operation.

Answer 7

Heat Activated Paper

Modern laser printers and copiers work via fusers. Fusers work by getting really hot. Like 200°c/400°f temperature ranges.

So you make paper that's heat activated. If it goes above about 100°c, it melts. This will mess up your printers and copiers. Repairs are disruptive: parts have to be ordered. Trained technicians have to be dispatched. Repair bills must be paid.

Interleave these pages such that there are between 0 and 3 sheets per ream (or better yet, box) of paper. This way, they don't know if or when their printer/copier will be taken offline and for how long.

Sure, CoC will switch paper vendors (once purchasing department decides to act and gets a new contract through the legal department. Government doesn't switch vendors quickly!) But this technology would be easy to do to all the paper vendors.

Answer 8

Lets add some chemicals to the paper. Semi-randomly (never the first or last sheet, never both chemicals in the same ream of paper) and at a low frequency.

Chemical A: Inert. Enough heat converts A to C.

Chemical B: Inert. Enough heat converts B to D.

C + D + pressure causes a slow reaction that produces crystals of E.

E has a very low ignition temperature and can be triggered by friction.

Result: A ream of paper can never be made to do evil--this will make this sabotage very hard to detect.

However, when you move the printed materials around the danger arises. You put a C paper in a folder and also a D paper. This state is still safe as the paper is merely sitting there. The danger arises when you stack up those folders, now you have the pressure and E is formed. Leave that stack alone for a while (storage) and it becomes dangerous. Now, when someone messes with it (say, opens the file drawer it's stored in) it may be triggered. It's possible the crystal is buried too deeply and goes out due to a lack of oxygen, but if it's close enough to the edge you may get a slowly smoldering fire, in time this can turn into a big fire.

CoC will in time figure out that the fires are sabotage but how will they trace it to the paper? Even if the identify E there's no E in the paper, they'll be looking elsewhere for where the E is coming from.

(You said some handwavium is acceptable. I don't know if suitable chemicals exist.)

Answer 9

There are two tremendously powerful uses for this level of access...

1). Intelligence Gathering: Who is paying for particular supplies and where those supplies are being sent are both incredibly valuable intelligence items. If the office supply needs of a toy factory are being paid for by the military then that factory is probably not making toys. If the Supreme Leader prefers a particular cigar or vintage champagne, then knowing what locations are stocking up on those products could help your assassins predict where he will be. If you can get hold of the requisition forms and see whose signatures authorize whose requests, you can quickly map out their entire command structure. This can have a tremendous demoralizing effect on the enemy. Imagine their reaction when your agency sends flowers and congratulation notes to all the recently promoted staff, celebrating their career advancement. It is the ultimate mind game; casually letting them know that you know everything about them.

Eat your heart out, Tokyo Rose!

2). Destruction of their Intelligence Gathering: Coat everything going to the intelligence agency in a slow acting, colorless, odorless neurotoxin which initially induces apathy and memory-loss, then progresses into paranoia and mild hallucinations.
As it takes affect, your enemy's intelligence community will loose its edge. They will diminish in their ability to keep track of you. Later, as the poisoning progresses, they will start providing their superiors with insane conspiracy theories and random misinformation. In their paranoia, they will mistrust the real information coming in from the field, replacing it with the products of their every increasing hallucinations.

If your looking for a sequel or a high tension ending for your story, there is an easily overlooked negative side to this destructive approach. It will eventually spread up into the enemy's command structure as letters and reports from the intelligence agency get sent to the Supreme Leader and his command staff. Now the commander of your enemy's nuclear arsenal is becoming a hallucinating paranoid and his staff is feeding into his delusion from hallucinations of their own.

Oops! Apocalypse!

Answer 10

Assuming you are using pens that have replaceable cartridges:

Treat some of the cartridges for fancier pens with a small dose of dimethyl mercury in dimethyl sulfoxide. This is inside the pen where it is normally not touched, but it's placed so that you're likely to touch it during cartridge replacement.

While this stuff is an incredibly lethal contact poison (even able to defeat latex gloves, so dangerous it is referred to as liquid death) we want to keep the dose below that point. The objective is to mess up their minds, not kill them. Think of the damage to the organization when some of the bosses (why we targeted the fancy pens) slowly become mad as a hatter. (I'm using this quite literally--hatters used to slowly go mad from occupational mercury exposure.)

Answer 11

If you wanted to maximise casualties and didn't care about the ethical consequences of your actions you could insert a biological vector such as anthrax in any of the items listed above. This would probably wipe out the whole of the office where you had supplied the goods to.

Answer 12

Not much, at least not for long

CoC also has some really smart people and there is probably a person or even a department dedicated to security. They would scrutinize everything if they detected a malware often in their computers. They will notice if there is wireless communication, it is not like they do not know about that you can communicate with electromagnetic waves (radio). They probably also follow statistically things, so if things start going wrong too often they will scrutinize everything. Also they are smart enough to check their suppliers facilities from time to time.

But still something

The real value comes from a coordinated joint attacks. When the effectiveness really matters, the supplier will give the bad stuff. A short circuit in their command center could be an attack signal at somewhere else. They will not suspect at first the office supplies, because these things happen statistically. So they will use them again, creating an another short circuit. This would make a real mess at that particular operation. But then the link would be lost.

PS. If you do not work in a big institution like ministry and do not know what the security people do, they are those crazy guys that tell you: not to wear suits because you will be recognized as a manager, not to put your your job in Facebook or LinkedIn because somebody may fish targets from those, not to even tell your friends that you work there because the word may spread and you can be targeted etc. Even though you are not doing nothing security critical and everything is public information. Nobody takes them seriously (and that is how the USB attacks still work :D). But in CoC agency I think these things would be taken really seriously, and enforced strictly. Especially being prime target to technologically advanced USE.

Answer 13

Modify the logic units in the calculators. When asked for a 4+ digit and 4+ digit multiplication or division there's a 1% chance it changes one of the middle digits to an adjacent number before doing the operation. If the errors are noticed it will take a lot to figure out this isn't just a case of fat-fingered users.

Answer 14

These are mostly nuisance ideas aimed at increasing workload and decreasing efficiency.

Anything powered can have a small circuit added to transmit noise at low powers on communications frequencies. Even battery-powered devices if it's just a pulse. A few devices combined and any wireless comms on those frequencies will start dropping or getting noisy. Distributed across devices means it's harder to track down the source and analogue lines would slowly degrade rather than a single event cutting them off.

Mains-powered devices could leak a small amount of current to ground, but only occasionally/only when they'd been on for a while. These would cause any RCDs (GFCIs) to trip, hopefully losing lots of unsaved data. The circuit to do this could be built in to the speed control of a desk fan.

Make the keyboard occasionally send Alt+F4, Alt+N to close work without saving. Or have you ever tried to use a keyboard with a stuck Ctrl key? How about one that randomly presses itself. Perhaps that's too subtle.

Printers could be modified to occasionally replace addresses on random letters with addresses you control, in the hope of exfiltrating things like employee information. This would best be done in large print runs (could the printer detect a mailmerge of annual pay letters?). Alternatively put an address that's an obvious red flag -- your own embassy if you still have one in the country -- to sow suspicions.

Anything with a large switch-mode power supply (laser printer, for example) could release infectious or even just unpleasant materials from a fake capacitor (an undersized cap in a big can, with the failure of the underspecced component triggering the release (and right next to a fan for easy distribution, in many printers, which could also spread it via paper). You could choose the severity of the agent, from H2S to flu and upwards.

Answer 15

Modify the keyboards/mice with a small amount of memory to deliver malware into a machine the first time it is plugged in--like an infected pen drive. If the machine is connected to the internet, you basically have a back door into the machine to do whatever you like, and you won't get spotted unless they've got a hardware firewall

Answer 16

If you don't care about civilian casualties and/or just want to kill everyone, biological weapons are the answer.

For maximal effect, use persistent spores that will only germinate under certain conditions. For example, if your pathogen only germinate upon a sudden transition from a cold, dry environment to a warm, wet environment, it would do nothing until winter when it would begin infecting peoples respiratory tracks. This would allow you to distribute the spores to the entire army before anyone noticed.

If you can time the distribution well enough, it does not even mater if your disease is lethal. When the entire defense force of a nation all becomes ill at the same time, you can invade with minimal resistance.

Answer 17

There are many possibilities but I would differentiate two concepts:

---

• Obtain information:

Discard the options that have already been said, to be more original.

Whiteboards

The whiteboards are placed in places where they are seen and usually have good visibility, so it is an ideal place to hide a micro camera.

How obtain this information?

Using the keyboard or the mouse, we can implement a micro data receiver, bluetooth for example, that receives the information of the whiteboard and this can be sent through the computer.

---

• To cause damage:

I'm going to explain some of the ideas I've had about causing damage to the enemy.

Printer toner

> We can use the ink to burn documents, mixing the ink with some product that is highly flammable with the temperature.

> Use of very sensitive biodegradable ink to spoil printers.

Consumer level batteries

> Modification of some batteries to generate toxins and chemical reactions damaging to the human body. By modifying the batteries to have a bad operation, they can be burned internally, this would generate harmful and highly toxic gases. Long exposure these gases can be a serious problem.

Desk Fans

> Modification of some the fans plugs to create a short circuit or dead short. This can end up generating voltage drops in the electrical circuit and even injuring people who manipulate it.