Home > CAPEC List > CAPEC-511: Infiltration of Software Development Environment (Version 2.10)  

CAPEC-511: Infiltration of Software Development Environment

 
Infiltration of Software Development Environment
Definition in a New Window Definition in a New Window
Attack Pattern ID: 511
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker uses common delivery mechanisms such as email attachments or removable media to infiltrate the IDE (Integrated Development Environment) of a victim manufacturer with the intent of implanting malware allowing for attack control of the victim IDE environment. The attack then uses this access to exfiltrate sensitive data or information, manipulate said data or information, and conceal these actions. This will allow and aid the attack to meet the goal of future compromise of a recipient of the victim's manufactured product further down in the supply chain.

+ Attack Prerequisites
  • The victim must use email or removable media from systems running the IDE (or systems adjacent to the IDE systems).

  • The victim must have a system running exploitable applications and/or a vulnerable configuration to allow for initial infiltration.

  • The attacker must have working knowledge of some if not all of the components involved in the IDE system as well as the infrastructure.

+ Typical Severity

High

+ Typical Likelihood of Exploit

Likelihood: Low

The nature of these type of attacks involve a coordinated effort between well-funded multiple attackers, and sometimes require physical access to successfully complete an attack. As a result these types of attacks are not launched on a large scale against any potential victim, but are typically highly targeted against victims who are often targeted and may have rather sophisticated cyber defenses already in place.

+ Examples-Instances

Description

The attacker, knowing the victim runs email on a system adjacent to the IDE system, sends a phishing email with a malicious attachment to the victim. When viewed, the malicious attachment installs a backdoor that allows the attacker to remotely compromise the adjacent IDE system from the victim's workstation. The attacker is then able to exfiltrate sensitive data about the software being developed on the IDE system.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

Intelligence about the manufacturer's operating environment and infrastructure.

Skill or Knowledge Level: High

Ability to develop, deploy, and maintain a stealth malicious backdoor program remotely in what is essentially a hostile environment.

Skill or Knowledge Level: High

Development skills to construct malicious attachments that can be used to exploit vulnerabilities in typical desktop applications or system configurations. The malicious attachments should be crafted well enough to bypass typical defensive systems (IDS, anti-virus, etc)

+ References
[R.511.1] [REF-50] John F. Miller. "Supply Chain Attack Framework and Attack Patterns". The MITRE Corporation. 2013. <http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2015-11-09Updated Related_Attack_Patterns, Typical_Likelihood_of_ExploitInternal
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017