COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-439

Manipulation During Distribution

An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging.

Abstraction

Meta

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging.

Requirements

What does the attack require?

Prerequisites

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Real world

MITRE example instances

Example instance 1Detail
A malicious OEM provider, or OEM provider employee or contractor, may install software, or modify existing code, during distribution.
Example instance 2Detail
External contractors involved in the packaging or testing of products or components may install software, or modify existing code, during distribution.
CAPEC-439: Manipulation During Distribution — DayBreach Saldırı Sözlüğü · DayBreach