Threat Vectors

Attackers exploit both the software supply chain and edge trust boundaries. The notes below mirror the investigative threads followed by Knox Ramsey.

Attack Chain: Supply Chain to Public Exposure

  1. 1 Initial Recon — Compromise 1 Vendor Recon
    Target profiling, supplier mapping, and foothold via a single vendor relationship.
  2. 2 Credential Harvest — API / Cert Leakage Recon
    Keys and certificates exposed through supplier systems and CI artifacts.
  3. 3 FarmLytics Infiltration — Weight Tampering Infiltration
    Poisoned model weights and policy packages enter the update channel.
  4. 4 Recipe Manipulation — Light/Nitrogen/Temp Infiltration
    Blue light spikes, nitrogen stress, and thermal oscillation encoded as "optimization".
  5. 5 FarmCore Executes — Telemetry Trusted Execution
    Edge controller accepts spoofed signals; Safety Kernel v1 fails to block.
  6. 6 Plant Stress — Phenolic Aldehydes Execution
    Biochemical defense cascades elevate toxins; crop quality silently degrades.
  7. 7 Distribution Chain — Contaminated Flow Impact
    Outbound logistics propagate contaminated batches beyond the facility boundary.
  8. 8 Public Exposure — Poisonings, ER Overload Crisis
    Health systems register spikes; investigations correlate distributed supply lots.

Supply Chain Compromise

Malicious model weights inserted before deployment. Configuration packages transit legitimate logistics, masking tampering.

  • Poisoned training data targeting spectral optimization
  • Signed firmware updated via trusted vendor portal
  • Orchestrated to appear as a calibration patch

Credential & Certificate Spoofing

Attackers forge trust anchors to bypass advisory-only safeguards.

  • Compromised certificate authority issues fraudulent edge certs
  • Shadow PKI mimics FarmLytics policy updates
  • Gateway accepts poisoned recipes as authentic

Closed-Loop Blind Spots

Safety Kernel v1 runs single-channel verification, allowing doctored telemetry to pass.

  • Shadow test relies on spoofed sensor replay
  • Logging occurs, but alerts are suppressed downstream
  • Upgraded Kernel v2 introduces dual-channel physics checks

Incident Lessons

Stuxnet, the Ukraine power grid attacks, TRITON/TRISIS, Colonial Pipeline, and the JBS intrusion demonstrate that cyber-physical exploits escalate quickly. The Dark Recipe plot aligns with documented tactics but compresses the timeline for dramatic effect.