Home > CAPEC List > CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation (Version 2.11)  

CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation

 
Malicious Logic Insertion into Product Software via Configuration Management Manipulation
Definition in a New Window Definition in a New Window
Attack Pattern ID: 445
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker exploits a configuration management system so that malicious logic is inserted into a software products build, update or deployed environment. If an attacker can control the elements included in a product's configuration management for build they can potentially replace, modify or insert code files containing malicious logic. If an attacker can control elements of a product's ongoing operational configuration management baseline they can potentially force clients receiving updates from the system to install insecure software when receiving updates from the server. Configuration management servers operate on the basis of a client pool, instructing each client on which software to install. In some cases the configuration management server will automate the software installation process. A malicious insider or an attacker who has compromised the server can alter the software baseline that clients must install, allowing the attacker to compromise a large number of satellite machines using the configuration management system. If an attacker can control elements of a product's configuration management for its deployed environment they can potentially alter fundamental security properties of the system based on assumptions that secure configurations are in place.

+ Attack Prerequisites
+ References
[R.445.1] [REF-31] Information Technology Laboratory. "Supply Chain Risk Management (SCRM)". National Institute of Standards and Technology (NIST). 2010.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team

More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2017