Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Other sub-techniques of Supply Chain Compromise (3)
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Procedure Examples |
|
| Name | Description |
|---|---|
| XCSSET |
XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods |
Mitigations |
|
| Mitigation | Description |
|---|---|
| Vulnerability Scanning |
Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. |
| Update Software |
Perform regular software updates to mitigate exploitation risk. |
Detection
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.
References
- Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019.
- Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
- OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.
Связанные риски
| Риск | Связи | |
|---|---|---|
|
Заражение вредоносным программным обеспечением из-за
возможности атаки на цепочку поставок программного обеспечения в программном обеспечении
Доступность
Конфиденциальность
Отказ в обслуживании
Повышение привилегий
Раскрытие информации
Целостность
Искажение
|
|
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.