Supply Chain Vulnerability Analysis Suggests Computers are Being Tampered with in China prior to shipment to the U.S.

Posted By: admin March 15, 2023

Last month, I discussed the analysis I performed on a $99 ASUS laptop purchased from Micro Center.

I analyzed this ASUS laptop as part of my investigation into supply chain cyber security.  My analysis of the new factory-sealed ASUS laptop was performed deep underground beyond the reach of cellular, Mesh Networking, Satelite other Wi-Fi signals that might allow the computer to be tampered with via nearby IOT or other electronic devices near the new laptop. The device had never been powered on (to the best of my knowledge) and appeared to be sealed without any visible tampering. I immediately entered the BIOS on the first boot to set a BIOS password and inspect the trusted platform keys. There were two unique keys installed on this new laptop.

The Microsoft Windows Production PCA 2011 certificate, 77FA9ABD03594D32BD6028F4E78F784B, was listed as one of two trusted platform keys in the BIOS.

The other trusted platform key in the BIOS was Shanghai-based “Huaqin NBD2 KEK certificate,” 6EC5EC6146B24535956C163CC365F118.

The trusted platform key is critical to securing what software is allowed to run on the processor.

However, the Microsoft key, 77FA9ABD03594D32BD6028F4E78F784B, was also listed as a forbidden platform key in the BIOS. When you list a key as trusted and forbidden, the net effect is that the key won’t validate installation packages that are signed by any platform key listed in the BIOS’s forbidden database even if it is also in the trusted platform key database. This essentially prevents the compromised computer from ever receiving important firmware updates needed to secure computing devices, including those used for critical infrastructure where similar alterations have occurred.

Any platform key that is in the forbidden list will now be allowed to vouch for software to run on the processor as legitimate.

This essentially disables any software signed by the Microsoft platform key from trusting security updates, patches, and other software from being able to execute on the processor. I attempted to delete the Huaqin platform key and it asked me if I was sure I wanted to delete the key from NVRAM. This finding suggests that RAM modules sourced from parties other than that provided by the original manufacturer may be another part of the threat landscape at risk to compromise.

This week, I performed a similar analysis of a Microsoft Surface Laptop Go 2 for Business – Platinum, Intel Core i5, 8GB RAM, 128GB SSD that was ordered by a fellow IT security researcher.

This order 6988677825 was placed on the microsoft.com website on December 6, 2022, at 6:41 PM.  The Microsoft Surface Laptop Go 2 for business came preloaded with OS Build 10.0.22000.36. This is an outdated December 2021 version of the operating system (10.0.0.22000.276 was the December 14, 2021, final release version for that month). The product didn’t have the packaging that was expected and appeared to have been tampered with after the initial build in June 2022. The shipping box said the laptop was made in China 06 2022 (June 2022). Why an outdated OS build was deployed on the Surface Laptop Go 2 for business can best be explained by a deliberate effort to deploy an old vulnerable version of the Microsoft Operating System. My forensic analysis of that image indicates that The December 2021 previous build was customized in January of 2022, before it was later deployed to the laptop post-assembly in China.

The laptop was shipped from Arvato Door 45 RFLV 2500 Export Drive, Louisville, KY 40219. Arvato is a Bertelsmann-owned subsidiary. The laptop had essentially a year-old preview operating system that had a weak software signing certificate deployed from an image built in January of 2022, but then the individual laptop was tweaked to add a custom Azure user account a custom encryption key before it was boxed up and delivered to the US for eventual delivery to my colleague that placed his order in December of 2022.

GTE CyberTrust Global Root vulnerable md5RSA Software Signing Certificate added to Surface Go 2 Laptop

Following receipt and inspection of the package, the new laptop was removed and booted to secure the UEFI pre-boot environment.  Inspection of the main (C) boot partition from the advanced recovery mode command line revealed that on January 18, 2022, modifications were made to the “C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\” folder, including the creation of an insecure certificate signing package “C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\libcacerts.pem”. This weak GlobalSign MD5 software signing certificate appears to have been built as an image for later deployments.

  1. C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib>c:\Windows\System32\certutil.exe -dump cacerts.pem
  2. X509 Certificate:
  3. Version: 1
  4. Serial Number: 01a5
  5. Signature Algorithm:
  6. Algorithm ObjectId: 1.2.840.113549.1.1.4 md5RSA
  7. Algorithm Parameters:
  8. 05 00
  9. Issuer:
  10. CN=GTE CyberTrust Global Root
  11. OU=GTE CyberTrust Solutions, Inc.
  12. O=GTE Corporation
  13. C=US
  14. Name Hash(sha1): 697bb4081898dfa9c6208c0fa897e2f60ee66c7e
  15. Name Hash(md5): 1d4d654df8262fc7e8be90f155a00b29
  17. NotBefore: 8/12/1998 4:29 PM
  18. NotAfter: 8/13/2018 3:59 PM
  20. Subject:
  21. CN=GTE CyberTrust Global Root
  22. OU=GTE CyberTrust Solutions, Inc.
  23. O=GTE Corporation
  24. C=US
  25. Name Hash(sha1): 697bb4081898dfa9c6208c0fa897e2f60ee66c7e
  26. Name Hash(md5): 1d4d654df8262fc7e8be90f155a00b29
  28. Public Key Algorithm:
  29. Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA (RSA_SIGN)
  30. Algorithm Parameters:
  31. 05 00
  32. Public Key Length: 1024 bits
  33. Public Key: UnusedBits = 0
  34. 0000 30 81 89 02 81 81 00 95 0f a0 b6 f0 50 9c e8 7a
  35. 0010 c7 88 cd dd 17 0e 2e b0 94 d0 1b 3d 0e f6 94 c0
  36. 0020 8a 94 c7 06 c8 90 97 c8 b8 64 1a 7a 7e 6c 3c 53
  37. 0030 e1 37 28 73 60 7f b2 97 53 07 9f 53 f9 6d 58 94
  38. 0040 d2 af 8d 6d 88 67 80 e6 ed b2 95 cf 72 31 ca a5
  39. 0050 1c 72 ba 5c 02 e7 64 42 e7 f9 a9 2c d6 3a 0d ac
  40. 0060 8d 42 aa 24 01 39 e6 9c 3f 01 85 57 0d 58 87 45
  41. 0070 f8 d3 85 aa 93 69 26 85 70 48 80 3f 12 15 c7 79
  42. 0080 b4 1f 05 2f 3b 62 99 02 03 01 00 01
  43. Certificate Extensions: 0
  44. Signature Algorithm:
  45. Algorithm ObjectId: 1.2.840.113549.1.1.4 md5RSA
  46. Algorithm Parameters:
  47. 05 00
  48. Signature: UnusedBits=0
  49. 0000 7f 7a 0b ab f9 cc a7 ba ad 95 cd b5 22 1f 4f ae
  50. 0010 aa c7 6d 85 5c 9d 1f 9e d8 94 cb ef 93 95 0f 0d
  51. 0020 a7 24 c4 34 85 a3 d7 b0 5b 5f 97 05 ec 8e bf 61
  52. 0030 68 f5 7c e2 d5 fa ba 4e 95 c0 b9 1e 42 8b d9 b1
  53. 0040 5c f3 ea f0 e9 18 54 63 9b 7d 55 76 f4 dc 7d b9
  54. 0050 d7 74 c8 40 df 4e 34 7b 9e 08 13 81 33 16 83 c5
  55. 0060 30 0e ab fb 3d 85 03 14 a2 73 de a6 7c a0 e3 77
  56. 0070 48 3c 2a a4 61 22 67 db 51 d9 5e e9 09 1b eb 6d
  57. Signature matches Public Key
  58. Root Certificate: Subject matches Issuer
  59. Key Id Hash(rfc-sha1): a60c1d9f61ff0717b5bf3846db4330d58eb05206
  60. Key Id Hash(sha1): 597912de6175d66fc423b7771374c796de6f8872
  61. Key Id Hash(bcrypt-sha1): d96f7667462f547917c58db4d86ad42368234265
  62. Key Id Hash(bcrypt-sha256): 6d715d0d3a76b9f0e8350632c8c98e16fb749fda8366939c7346a6e3f893ba0b
  63. Key Id Hash(md5): b9632f69390c2f2d6b23e01fec8c7389
  64. Key Id Hash(sha256): f5821f4358e777462928058e50f3c699e617c8baf1e68a945c5aa4bf7f337d95
  65. Key Id Hash(pin-sha256): EGn6R6CqT4z3ERscrqNl7q7RC//zJmDe9uBhS/rnCHU=
  66. Key Id Hash(pin-sha256-hex): 1069fa47a0aa4f8cf7111b1caea365eeaed10bfff32660def6e0614bfae70875
  67. Cert Hash(md5): ca3dd368f1035cd032fab82b59e85adb
  68. Cert Hash(sha1): 97817950d81c9670cc34d809cf794431367ef474
  69. Cert Hash(sha256): a53125188d2110aa964b02c7b7c6da3203170894e5fb71fffb6667d5e6810a36
  70. Signature Hash: e1b34a19374fc710c61667b82e8f1c2c
  71. CertUtil: -dump command completed successfully.
  73. C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib>dir *
  74. Volume in drive C is Local Disk
  75. Volume Serial Number is CE99-32AA
  77. Directory of C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib
  79. 01/18/2022 06:20 PM <DIR> .
  80. 01/18/2022 06:20 PM <DIR> ..
  81. 01/18/2022 06:20 PM <DIR> 1033
  82. 01/18/2022 06:20 PM <DIR> 1036
  83. 01/18/2022 06:20 PM <DIR> 3082
  84. 01/18/2022 06:20 PM 255,048 cacerts.pem
  85. 01/18/2022 06:20 PM <DIR> LibCurl64.DllA
  86. 01/18/2022 06:20 PM <DIR> OpenSSL64.DllA
  87. 01/18/2022 06:20 PM 27,109,768 sbicudt58_64.dll
  88. 01/18/2022 06:20 PM 2,431,880 sbicuin58_64.dll
  89. 01/18/2022 06:20 PM 1,783,688 sbicuuc58_64.dll
  90. 01/18/2022 06:20 PM 320 sfodbc.did
  91. 01/18/2022 06:20 PM 17,979,800 sfodbc_sb64.dll
  92. 01/18/2022 06:19 PM 281,472 zlibwapi.dll
  93. 7 File(s) 49,841,976 bytes
  94. 7 Dir(s) 91,787,829,248 bytes free

Custom Digital Certificate Deployed in China upon assemble in June 2022

Inspection of the Surface Go 2 hard drive restore (D) partition revealed that beginning on June 2022, the default user profile “defaultuser0” was created on the laptop on June 15, 2022, presumably when the computer was manufactured as noted on the shipping box.  My examination of the laptop using the advanced recovery command line shell performed underground away from wireless networks revealed some interesting findings. Some of the source data I posted on Pastebin.com.

A certificate package signed by GTE CyberTrust Global Root that expired in August of 2018 used a weak md5 RSA cryptographic algorithm that had been placed within the main OS partition inside the following location: C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem

The reference to Salesforce suggests this particular certificate may be targeting Microsoft Office users and SalesForce.com, one of the leading corporate ERP cloud software systems. A similar finding from a completely different order of a new Microsoft Surface Pro 5 for business was discovered as well.

Additionally, I observed that the D:\Recovery\WindowsRE advanced recovery boot partition had been modified on June 15, 2022.  The Logs folder indicated activity on June 20th, 2022, presumably the date the laptop was packaged for shipment.  This Winre.wim had a private key that was not signed by Microsoft.  This finding had my curiosity peaked regarding the potential that the Chinese may have figured out how to preconfigure Azure active directory as a tenant to surveil and manage computers remotely.

The Microsoft Connected Devices Platform device certificate had a narrow validity date beginning on June 15, 2022 and ending on June 16, 2022. This key may serve to connect the device to other devices in use by the user once they personalize their new laptop with their Microsoft ID. 

D:\windows\serviceprofiles\localservice\appdata\local\connecteddevicesplatform\Connected Devices Platform certificates.sst

Unfortunately, the claims made on Microsoft’s website about providing secure firmware on business versions of their Surface Pro laptops don’t appear to have been achieved in this instant. Microsoft needs to begin offering securely signed read-only boot media that can fully deliver the most recently issued month’s Operating system with all required security updates for the pre-boot platform keys, drivers, and the operating system. US Governments at the Federal and State levels need to implement regulations requiring the hardware providers to audit and fully update firmware and security updates in the US before delivery to end-point customers.

Further examination of the more recently ordered Microsoft Surface Pro 5 Laptop for business revealed that many unsigned PowerShell scripts are packaged within the installed hard drive ready to perform further untrusted actions. Microsoft needs to audit its own equipment prior to it being delivered to businesses, the military, critical infrastructure and consumers. There is no reasonable explanation for why Windows computers everywhere are running .exe and .dll files that are not signed. Try Control Alt Delete and see if your conhost.exe file within the c:\Windows\System32\ folder is unsigned or signed. All other executables and driver link library files sitting in that directory should have a Digital Signature tab like the following when you right click and select properties.

Example of an Unsigned conhost.exe file that is unsigned and can be found in the wild on most Windows 10 / 11 computers in operation throughout the U.S.

Example of an Application File that has a Digital Signature Tab

We have reached out to Microsoft and hope to obtain their assistance with our investigation. We never received a follow up call.

Windows Updates over the Internet are not working

Internet delivery of the latest security updates is being compromised by content injection from JavaScript enabled in part because of the lack of effective implementation of DNSSEC.  The supply chain of computers shipping from China has many computers misconfigured prior to shipment to the US.  Computer assemblers should be required to use the latest operating system version with all security patches applied before the computer is shipped to the US or delivered to the final customer.  The latest example from our analysis shows that the Microsoft Surface had new certificate authorities installed during the assembly process, an earlier outdated December 2021 operating system version tweaked with custom modifications to Microsoft Office and Salesforce inserting certificate signed by a weak and expired GTE CyberTrust Global Root Certificate authority allowing for easy compromise on first boot.  Every IT person should inspect new equipment prior to the initial full boot of the BIOS to look for evidence of tampering with the recovery partition. Using CERTUTIL from the advanced recovery command line, prior to the initial boot is a good way to understand what is there.

CISA has issued a number of advisories that provide important information regarding vulnerabilities with software updates and the supply chain.

ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER.PDF (defense.gov)

Securing the Software Supply Chain: Recommended Practices Guide for Developers (defense.gov)

SECURING_THE_SOFTWARE_SUPPLY_CHAIN_SUPPLIERS.PDF (defense.gov)

Other Recent News Stories from CISA

U.S. cyber chief warns tech companies to curb unsafe practices – CBS News

CISA: Tech industry ‘shouldn’t tolerate’ Patch Tuesday | IT PRO

Facebook Comments

Be the first to comment on "Supply Chain Vulnerability Analysis Suggests Computers are Being Tampered with in China prior to shipment to the U.S."

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.