CAPEC-538
Open-Source Library Manipulation
Niedrig
Hoch
Stable
2014-06-23
00h00 +00:00
00h00 +00:00
2023-01-24
00h00 +00:00
00h00 +00:00
Benachrichtigung für ein CAPEC
Bleiben Sie über alle Änderungen zu einem bestimmten CAPEC informiert.
CAPEC-Beschreibungen
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.
CAPEC-Informationen
Ausführungsablauf
1) Explore
[Determine the relevant open-source code project to target] The adversary will make the selection based on various criteria:
2) Experiment
[Develop a plan for malicious contribution] The adversary develops a plan to contribute malicious code, taking the following into consideration:
3) Exploit
[Execute the plan for malicious contribution] Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscure the attack. Monitor the contribution site to try to determine if the code has been uploaded to the target system.
Voraussetzungen
Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.Erforderliche Kenntnisse
Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.Verwandte Schwachstellen
| Name der Schwachstelle | |
|---|---|
CWE-494 |
Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
Referenzen
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
Einreichung
| Name | Organisation | Datum | Veröffentlichungsdatum |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Änderungen
| Name | Organisation | Datum | Kommentar |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
