CAPEC-443
Malicious Logic Inserted Into Product by Authorized Developer
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
An adversary uses their privileged position within an authorized development organization to inject malicious logic into a codebase or product.
CAPEC 정보
사전 조건
Access to the product during the initial or continuous development.완화 방법
Assess software and hardware during development and prior to deployment to ensure that it functions as intended and without any malicious functionality. This includes both initial development, as well as updates propagated to the product after deployment.참고 자료
REF-379
Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2nd Draft)Jon Boyens, Angela Smith, Nadya Bartol, Kris Winkler, Alex Holbrook, Matthew Fallon.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-draft2.pdf
REF-704
Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of appsAx Sharma.
https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/
REF-705
Malicious modifications to open source projects affecting thousandsAlberto Pellitteri.
https://sysdig.com/blog/malicious-modifications-detection-sysdig/
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Mitigations, References | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Extended_Description, Mitigations, Prerequisites, Related_Attack_Patterns, Taxonomy_Mappings |
