CAPEC 描述
An adversary introduces malicious hardware during an update or replacement procedure, allowing for additional compromise or site disruption at the victim location. After deployment, it is not uncommon for upgrades and replacements to occur involving hardware and various replaceable parts. These upgrades and replacements are intended to correct defects, provide additional features, and to replace broken or worn-out parts. However, by forcing or tricking the replacement of a good component with a defective or corrupted component, an adversary can leverage known defects to obtain a desired malicious impact.
CAPEC 資訊
所需技能
Able to develop and manufacture malicious hardware components that perform the same functions and processes as their non-malicious counterparts.參考資料
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
REF-711
Shattered Trust: When Replacement Smartphone Components AttackOmer Shwartz, Amir Cohen, Asaf Shabtai, Yossi Oren.
https://www.usenix.org/system/files/conference/woot17/woot17-paper-shwartz.pdf
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Prerequisites, Description Summary, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Description Summary, Examples-Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated References |
