CWE-506
Embedded Malicious Code
2006-07-19
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
일반 정보
배경 세부 정보
취약점 도입 방식
ImplementationBundling
Distribution
Installation
적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands |
관찰된 예시
| 참고 자료 | 설명 |
|---|---|
CVE-2022-30877 | A command history tool was shipped with a code-execution backdoor inserted by a malicious party. |
잠재적 완화 방법
Phases : Implementation // OperationRemove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
탐지 방법
Manual Static Analysis - Binary or Bytecode
효과성 : SOAR PartialDynamic Analysis with Manual Results Interpretation
효과성 : SOAR PartialManual Static Analysis - Source Code
효과성 : SOAR PartialAutomated Static Analysis
효과성 : SOAR Partial취약점 매핑 메모
근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate댓글 : Examine children of this entry to see if there is a better fit
관련 공격 패턴
| CAPEC ID | 공격 패턴 이름 |
|---|---|
| CAPEC-442 | Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain. |
| CAPEC-448 | Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop. |
| CAPEC-636 | Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover. |
메모
It is suspected that malicious code can often be characterized using other "regular" weaknesses related to insecure behavior. However, this has not been closely investigated.The term "Trojan horse" was introduced by Dan Edwards and recorded by James Anderson [18] to characterize a particular computer security threat; it has been redefined many times [4,18-20].
참고 자료
REF-1431
A Taxonomy of Computer Program Security Flaws, with ExamplesCarl E. Landwehr, Alan R. Bull, John P. McDermott, William S. Choi.
https://cwe.mitre.org/documents/sources/ATaxonomyofComputerProgramSecurityFlawswithExamples%5BLandwehr93%5D.pdf
REF-1479
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and EvaluationGregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
제출
| 이름 | 조직 | 날짜 | 출시일 | Version |
|---|---|---|---|---|
| Landwehr | Draft 3 |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Description, Other_Notes | |
| CWE Content Team | MITRE | updated Other_Notes, Terminology_Notes | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Detection_Factors, References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples, Relationship_Notes, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Background_Details, Demonstrative_Examples, Description |
