CAPEC-538
Open-Source Library Manipulation
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
掌握特定 CAPEC 的任何變更。
CAPEC 描述
Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.
CAPEC 資訊
執行流程
1) Explore
[Determine the relevant open-source code project to target] The adversary will make the selection based on various criteria:
2) Experiment
[Develop a plan for malicious contribution] The adversary develops a plan to contribute malicious code, taking the following into consideration:
3) Exploit
[Execute the plan for malicious contribution] Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscure the attack. Monitor the contribution site to try to determine if the code has been uploaded to the target system.
前置條件
Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.所需技能
Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.相關弱點
| 弱點名稱 | |
|---|---|
CWE-494 |
Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
參考資料
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns, Typical_Likelihood_of_Exploit | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
