Threat Vectors

Attackers exploit both the software supply chain and edge trust boundaries. The notes below mirror the investigative threads followed by Knox Ramsey.

Attack Chain: Supply Chain to Public Exposure

  1. 1 Initial Recon — Compromise 1 Vendor Recon
    Target profiling, supplier mapping, and foothold via a single vendor relationship.
  2. 2 Credential Harvest — API / Cert Leakage Recon
    Keys and certificates exposed through supplier systems and CI artifacts.
  3. 3 FarmLytics Infiltration — Weight Tampering Infiltration
    Poisoned model weights and policy packages enter the update channel.
  4. 4 Recipe Manipulation — Light/Nitrogen/Temp Infiltration
    Blue light spikes, nitrogen stress, and thermal oscillation encoded as "optimization".
  5. 5 FarmCore Executes — Telemetry Trusted Execution
    Edge controller accepts spoofed signals; Safety Kernel v1 fails to block.
  6. 6 Plant Stress — Phenolic Aldehydes Execution
    Biochemical defense cascades elevate toxins; crop quality silently degrades.
  7. 7 Distribution Chain — Contaminated Flow Impact
    Outbound logistics propagate contaminated batches beyond the facility boundary.
  8. 8 Public Exposure — Poisonings, ER Overload Crisis
    Health systems register spikes; investigations correlate distributed supply lots.

Attack Flow (Large Diagram)

Supply Chain → Infiltration → Execution → Impact → Crisis
flowchart LR subgraph P1[Recon] A["Initial Recon
Compromise 1 Vendor"] --> B["Credential Harvest
API / Cert Leakage"] end subgraph P2[Infiltration] C["FarmLytics Infiltration
Model Weight Tampering"] --> D["Recipe Manipulation
Light Spikes · N Stress · Temp Oscillation"] end subgraph P3[Execution] E["FarmCore Executes
Telemetry Trusted"] --> F["Plant Stress
Phenolic Aldehydes ↑"] end subgraph P4[Impact] G["Distribution Chain
Contaminated Flow"] end subgraph P5[Crisis] H["Public Exposure
Poisonings · ER Overload"] end B --> C D --> E F --> G G --> H classDef recon fill:#ffd4a3,stroke:#ff9d4d,stroke-width:2px,color:#1a1a1a classDef infiltrate fill:#ffb3b3,stroke:#ff6666,stroke-width:2px,color:#1a1a1a classDef execute fill:#d4b3ff,stroke:#9966ff,stroke-width:2px,color:#1a1a1a classDef impact fill:#ff9999,stroke:#ff4444,stroke-width:2px,color:#1a1a1a classDef crisis fill:#ff6666,stroke:#cc0000,stroke-width:3px,color:#fff class A,B,P1 recon class C,D,P2 infiltrate class E,F,P3 execute class G,P4 impact class H,P5 crisis
Tip: Scroll to zoom · Drag to pan
Open full-screen chart →

Supply Chain Compromise

Malicious model weights inserted before deployment. Configuration packages transit legitimate logistics, masking tampering.

  • Poisoned training data targeting spectral optimization
  • Signed firmware updated via trusted vendor portal
  • Orchestrated to appear as a calibration patch

Credential & Certificate Spoofing

Attackers forge trust anchors to bypass advisory-only safeguards.

  • Compromised certificate authority issues fraudulent edge certs
  • Shadow PKI mimics FarmLytics policy updates
  • Gateway accepts poisoned recipes as authentic

Closed-Loop Blind Spots

Safety Kernel v1 runs single-channel verification, allowing doctored telemetry to pass.

  • Shadow test relies on spoofed sensor replay
  • Logging occurs, but alerts are suppressed downstream
  • Upgraded Kernel v2 introduces dual-channel physics checks

Incident Lessons

Stuxnet, the Ukraine power grid attacks, TRITON/TRISIS, Colonial Pipeline, and the JBS intrusion demonstrate that cyber-physical exploits escalate quickly. The Dark Recipe plot aligns with documented tactics but compresses the timeline for dramatic effect.