CAPEC-538
Open-Source Library Manipulation
Bajo
Alto
Stable
2014-06-23
00h00 +00:00
00h00 +00:00
2023-01-24
00h00 +00:00
00h00 +00:00
Alerta para un CAPEC
Manténgase informado sobre cualquier cambio en un CAPEC específico.
Descripciones CAPEC
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.
Informaciones CAPEC
Flujo de ejecución
1) Explore
[Determine the relevant open-source code project to target] The adversary will make the selection based on various criteria:
2) Experiment
[Develop a plan for malicious contribution] The adversary develops a plan to contribute malicious code, taking the following into consideration:
3) Exploit
[Execute the plan for malicious contribution] Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscure the attack. Monitor the contribution site to try to determine if the code has been uploaded to the target system.
Prerrequisitos
Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.Habilidades requeridas
Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.Debilidades relacionadas
| Nombre de la debilidad | |
|---|---|
CWE-494 |
Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
Referencias
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
Envío
| Nombre | Organización | Fecha | Fecha de lanzamiento |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modificaciones
| Nombre | Organización | Fecha | Comentario |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
