CAPEC-537: Infiltration of Hardware Development Environment

Detailed Draft 严重程度: High 攻击可能性: Low

CAPEC版本: 3.9

更新日期: 2023-01-24

攻击模式描述

An adversary, leveraging the ability to manipulate components of primary support systems and tools within the development and production environments, inserts malicious software within the hardware and/or firmware development environment. The infiltration purpose is to alter developed hardware components in a system destined for deployment at the victim's organization, for the purpose of disruption or further compromise.

前提条件

The victim must use email or removable media from systems running the IDE (or systems adjacent to the IDE systems).
The victim must have a system running exploitable applications and/or a vulnerable configuration to allow for initial infiltration.
The adversary must have working knowledge of some if not all of the components involved in the IDE system as well as the infrastructure.

所需技能

Medium Intelligence about the manufacturer's operating environment and infrastructure.

High Ability to develop, deploy, and maintain a stealth malicious backdoor program remotely in what is essentially a hostile environment.

High Development skills to construct malicious attachments that can be used to exploit vulnerabilities in typical desktop applications or system configurations. The malicious attachments should be crafted well enough to bypass typical defensive systems (IDS, anti-virus, etc)

缓解措施

Verify software downloads and updates to ensure they have not been modified be adversaries

Leverage antivirus tools to detect known malware

Do not download software from untrusted sources

Educate designers, developers, engineers, etc. on social engineering attacks to avoid downloading malicious software via attacks such as phishing attacks

分类映射

分类名称	条目ID	条目名称
ATTACK	1195.003	Supply Chain Compromise: Compromise Hardware Supply Chain

关键信息

CAPEC ID: CAPEC-537

抽象级别: Detailed

状态: Draft

典型严重程度: High

攻击可能性: Low