CAPEC-636
Hiding Malicious Data or Code within Files
2018-05-31
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.
CAPEC の情報
前提条件
The operating system must support a file system that allows for alternate data storage for a file.緩和策
Many tools are available to search for the hidden data. Scan regularly for such data using one of these tools.関連する弱点
| 弱点名 | |
|---|---|
CWE-506 |
Embedded Malicious Code The product contains code that appears to be malicious in nature. |
参考文献
REF-493
Alternate Data Streams: Out of the Shadows and into the LightMeans, Ryan L..
https://www.giac.org/paper/gcwn/230/alternate-data-streams-shadows-light/104234
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
