COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-538

Open-Source Library Manipulation

Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine the relevant open-source code project to target

The adversary will make the selection based on various criteria:

Attack step

The depth in the dependency graph of the open source code in relationship to other code bases in use on the target system. Choosing an OSS lower in the graph decreases the probability of discovery, but also decreases the scope of its use within the target system.

Attack step

The programming language in which the open source code is implemented. Different languages present different opportunities for using known software weaknesses.

Attack step

The quality of processes in place to make a contribution. For instance, some contribution sites use static and dynamic analysis tools, which could increase the probability of discovery.

Attack step

The security requirements necessary to make a contribution. For instance, is the ownership lax allowing unsigned commits or anonymous users.
2

Experiment

Develop a plan for malicious contribution

The adversary develops a plan to contribute malicious code, taking the following into consideration:

Attack step

Common coding errors or missing edge cases of the algorithm, which can be explained away as being accidental, if discovered, will be preferred by the adversary.

Attack step

Sometimes no identity is required to make a contribution. Other options are to steal an existing identity or create one. When creating a new identity, strike a balance between too little or too much detail. Using an stolen identity could cause a notification to be sent to the actual user.
3

Exploit

Execute the plan for malicious contribution

Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscure the attack. Monitor the contribution site to try to determine if the code has been uploaded to the target system.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location.

Gerekli beceri

  • High: Advanced knowledge about the inclusion and specific usage of an open source code project within system being targeted for infiltration.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An adversary with access to an open source code project introduces a hard-to-find bug in the software that allows under very specific conditions for encryption to be disabled on data streams. The adversary commits the change to the code which is picked up by a manufacturer who develops VPN software. It is eventually deployed at the victim's location where the very specific conditions are met giving the adversary the ability to sniff plaintext traffic thought to be encrypted. This can provide to the adversary access to sensitive data of the victim.