COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-539

ASIC With Malicious Functionality

An attacker with access to the development environment process of an application-specific integrated circuit (ASIC) for a victim system being developed or maintained after initial deployment can insert malicious functionality into the system for the purpose of disruption or further compromise.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An attacker with access to the development environment process of an application-specific integrated circuit (ASIC) for a victim system being developed or maintained after initial deployment can insert malicious functionality into the system for the purpose of disruption or further compromise.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The attacker must have working knowledge of some if not all of the components involved in the target system as well as the infrastructure and development environment of the manufacturer.
  • Advanced knowledge about the ASIC installed within the target system.

Gerekli beceri

  • High: Able to develop and manufacture malicious subroutines for an ASIC environment without degradation of existing functions and processes.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
A hardware manufacturer periodically updates its ASIC with new features. The attacker, knowing the manufacturer runs email on a system adjacent to the hardware development systems used for ASIC design, sends a phishing email with a malicious attachment to the manufacturer. When viewed, the malicious attachment installs a backdoor that allows the attacker to remotely compromise the adjacent ASIC development system. The attacker is then able to exfiltrate and alter sensitive data on the ASIC system, allowing for future compromise once a new AISC is deployed at the victim location.
CAPEC-539: ASIC With Malicious Functionality — DayBreach Saldırı Sözlüğü · DayBreach