CAPEC-538
Open-Source Library Manipulation
2014-06-23
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.
CAPEC の情報
実行フロー
1) Explore
[Determine the relevant open-source code project to target] The adversary will make the selection based on various criteria:
2) Experiment
[Develop a plan for malicious contribution] The adversary develops a plan to contribute malicious code, taking the following into consideration:
3) Exploit
[Execute the plan for malicious contribution] Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscure the attack. Monitor the contribution site to try to determine if the code has been uploaded to the target system.
前提条件
Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.必要なスキル
Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.関連する弱点
| 弱点名 | |
|---|---|
CWE-494 |
Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
参考文献
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
