CAPEC-186
Malicious Software Update
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source.
CAPEC 정보
실행 흐름
1) Explore
[Identify target] The adversary must first identify what they want their target to be. Because malicious software updates can be carried out in a variety of ways, the adversary will first not only identify a target program, but also what users they wish to target. This attack can be targeted (a particular user or group of users) or untargeted (many different users).
2) Experiment
[Craft a deployment mechanism based on the target] The adversary must craft a deployment mechanism to deploy the malicious software update. This mechanism will differ based on if the attack is targeted or untargeted.
기법
- Targeted attack: hosting what appears to be a software update, then harvesting actual email addresses for an organization, or generating commonly used email addresses, and then sending spam, phishing, or spear-phishing emails to the organization's users requesting that they manually download and install the malicious software update.
- Targeted attack: Instant Messaging virus payload, which harvests the names from a user's contact list and sends instant messages to those users to download and apply the update
- Untargeted attack: Spam the malicious update to as many users as possible through unsolicited email, instant messages, or social media messages.
- Untargeted attack: Send phishing emails to as many users as possible and pretend to be a legitimate source suggesting to download an important software update.
- Untargeted attack: Use trojans/botnets to aid in either of the two untargeted attacks.
3) Exploit
[Deploy malicious software update] Using the deployment mechanism from the previous step, the adversary gets a user to install the malicious software update.
필요 기술
This attack requires advanced cyber capabilities필요 리소스
Manual or user-assisted attacks require deceptive mechanisms to trick the user into clicking a link or downloading and installing software. Automated update attacks require the adversary to host a payload and then trigger the installation of the payload code.완화 방법
Validate software updates before installing.관련 약점
| 약점 이름 | |
|---|---|
CWE-494 |
Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
참고 자료
REF-697
New ransomware, old techniques: Petya adds worm capabilitiesMicrosoft Defender Security Research Team.
https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Activation_Zone, Attack_Motivation-Consequences, Attacker_Skills_or_Knowledge_Required, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Solutions_and_Mitigations, Typical_Severity | |
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences, Description Summary | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Notes | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances, Extended_Description, References, Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
