deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-657: Malicious Automated Software Update via Spoofing

Description:
An attackers uses identify or content spoofing to trick a client into performing an automated software update from a malicious source. A malicious automated software update that leverages spoofing can include content or identity spoofing as well as protocol spoofing. Content or identity spoofing attacks can trigger updates in software by embedding scripted mechanisms within a malicious web page, which masquerades as a legitimate update source. Scripting mechanisms communicate with software components and trigger updates from locations specified by the attackers' server. The result is the client believing there is a legitimate software update available but instead downloading a malicious update from the attacker.

Related CWEs: 494
MITRE CAPEC-66: SQL Injection

Description:
This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input.

Mitigations:
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as SQL content. Keywords such as UNION, SELECT or INSERT must be filtered in additio
  - Use of parameterized queries or stored procedures - Parameterization causes the input to be restricted to certain domains, such as strings or integers, and any input outside such domains is considered
  - Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about 

Related CWEs: 89, 1286
MITRE CAPEC-660: Root/Jailbreak Detection Evasion via Hooking

Description:
An adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Adversaries may further leverage these capabilities to escalate privileges or bypass access control on legitimate applications. Although many mobile applications check if a mobile device is Rooted/Jailbroken prior to authorized use of the application, adversaries may be able to "hook" code in order to circumvent these checks. Successfully evading Root/Jailbreak detection allows an adversary to execute administrative commands, obtain confidential data, impersonate legitimate users of the application, and more.

Mitigations:
  - Ensure mobile applications are signed appropriately to avoid code inclusion via hooking.
  - Inspect the application's memory for suspicious artifacts, such as shared objects/JARs or dylibs, after other Root/Jailbreak detection methods.
  - Inspect the application's stack trace for suspicious method calls.

Related CWEs: 829
MITRE CAPEC-661: Root/Jailbreak Detection Evasion via Debugging

Description:
An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides users with access to system debuggers and disassemblers, which can be leveraged to exploit applications by dumping the application's memory at runtime in order to remove or bypass signature verification methods. This further allows the adversary to evade Root/Jailbreak detection mechanisms, which can result in execution of administrative commands, obtaining confidential data, impersonating legitimate users of the application, and more.

Mitigations:
  - Instantiate checks within the application code that ensures debuggers are not attached.

Related CWEs: 489
MITRE CAPEC-662: Adversary in the Browser (AiTB)

Description:
An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.

Mitigations:
  - Ensure software and applications are only downloaded from legitimate and reputable sources, in addition to conducting integrity checks on the downloaded component.
  - Leverage anti-malware tools, which can detect Trojan Horse malware.
  - Use strong, out-of-band mutual authentication to always fully authenticate both ends of any communications channel.

Related CWEs: 300, 494
MITRE CAPEC-663: Exploitation of Transient Instruction Execution

Description:
An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel attack to target non-discarded microarchitectural changes caused by transient executions such as speculative execution, branch prediction, instruction pipelining, and/or out-of-order execution. The transient execution results in a series of instructions (gadgets) which construct covert channel and access/transfer the secret data.

Mitigations:
  - Implementation: DAWG (Dynamically Allocated Way Guard) - processor cache properly divided between different programs/processes that don't share resources
  - Implementation: KPTI (Kernel Page-Table Isolation) to completely separate user-space and kernel space page tables
  - Configuration: Architectural Design of Microcode to limit abuse of speculative execution and out-of-order execution

Related CWEs: 1037, 1303, 1264
MITRE CAPEC-664: Server Side Request Forgery

Description:
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

Mitigations:
  - Handling incoming requests securely is the first line of action to mitigate this vulnerability. This can be done through URL validation.
  - Further down the process flow, examining the response and verifying that it is as expected before sending would be another way to secure the server.
  - Allowlist the DNS name or IP address of every service the web application is required to access is another effective security measure. This ensures the server cannot make external requests to arbitrar

Related CWEs: 918, 20
MITRE CAPEC-665: Exploitation of Thunderbolt Protection Flaws

Description:
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

Mitigations:
  - Implementation: Kernel Direct Memory Access Protection
  - Configuration: Enable UEFI option USB Passthrough mode - Thunderbolt 3 system port operates as USB 3.1 Type C interface
  - Configuration: Enable UEFI option DisplayPort mode - Thunderbolt 3 system port operates as video-only DP interface

Related CWEs: 345, 353, 288, 1188, 862
MITRE CAPEC-666: BlueSmacking

Description:
An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.

Mitigations:
  - Disable Bluetooth when not being used.
  - When using Bluetooth, set it to hidden or non-discoverable mode.

Related CWEs: 404
MITRE CAPEC-667: Bluetooth Impersonation AttackS (BIAS)

Description:
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.

Mitigations:
  - Disable Bluetooth in public places.
  - Verify incoming Bluetooth connections; do not automatically trust.
  - Change default PIN passwords and always use one when connecting.

Related CWEs: 290
MITRE CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)

Description:
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.

Mitigations:
  - Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.

Related CWEs: 425, 285, 693
MITRE CAPEC-669: Alteration of a Software Update

Description:
An adversary with access to an organization’s software update infrastructure inserts malware into the content of an outgoing update to fielded systems where a wide range of malicious effects are possible. With the same level of access, the adversary can alter a software update to perform specific malicious acts including granting the adversary control over the software’s normal functionality.

Mitigations:
  - Have a Software Assurance Plan that includes maintaining strict configuration management control of source code, object code and software development, build and distribution tools; manual code reviews
  - Require elevated privileges for distribution of software and software updates.
MITRE CAPEC-67: String Format Overflow in syslog()

Description:
This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter leading to a format string injection attack. Adversaries can then inject malicious format string commands into the function call leading to a buffer overflow. There are many reported software vulnerabilities with the root cause being a misuse of the syslog() function.

Mitigations:
  - The code should be reviewed for misuse of the Syslog function call. Manual or automated code review can be used. The reviewer needs to ensure that all format string functions are passed a static strin

Related CWEs: 120, 134, 74, 20, 680, 697
MITRE CAPEC-670: Software Development Tools Maliciously Altered

Description:
An adversary with the ability to alter tools used in a development environment causes software to be developed with maliciously modified tools. Such tools include requirements management and database tools, software design tools, configuration management tools, compilers, system build tools, and software performance testing and load testing tools. The adversary then carries out malicious acts once the software is deployed including malware infection of other systems to support further compromises.

Mitigations:
  - Have a security concept of operations (CONOPS) for the development environment that includes: Maintaining strict security administration and configuration management of requirements management and dat
  - Avoid giving elevated privileges to developers.
MITRE CAPEC-671: Requirements for ASIC Functionality Maliciously Altered

Description:
An adversary with access to functional requirements for an application specific integrated circuit (ASIC), a chip designed/customized for a singular particular use, maliciously alters requirements derived from originating capability needs. In the chip manufacturing process, requirements drive the chip design which, when the chip is fully manufactured, could result in an ASIC which may not meet the user’s needs, contain malicious functionality, or exhibit other anomalous behaviors thereby affecting the intended use of the ASIC.

Mitigations:
  - Utilize DMEA’s (Defense Microelectronics Activity) Trusted Foundry Program members for acquisition of microelectronic components.
  - Ensure that each supplier performing hardware development implements comprehensive, security-focused configuration management including for hardware requirements and design.
  - Require that provenance of COTS microelectronic components be known whenever procured.
MITRE CAPEC-672: Malicious Code Implanted During Chip Programming

Description:
During the programming step of chip manufacture, an adversary with access and necessary technical skills maliciously alters a chip’s intended program logic to produce an effect intended by the adversary when the fully manufactured chip is deployed and in operational use. Intended effects can include the ability of the adversary to remotely control a host system to carry out malicious acts.

Mitigations:
  - Utilize DMEA’s (Defense Microelectronics Activity) Trusted Foundry Program members for acquisition of microelectronic components.
  - Ensure that each supplier performing hardware development implements comprehensive, security-focused configuration management of microcode and microcode generating tools and software.
  - Require that provenance of COTS microelectronic components be known whenever procured.
MITRE CAPEC-673: Developer Signing Maliciously Altered Software

Description:
Software produced by a reputable developer is clandestinely infected with malicious code and then digitally signed by the unsuspecting developer, where the software has been altered via a compromised software development or build process prior to being signed. The receiver or user of the software has no reason to believe that it is anything but legitimate and proceeds to deploy it to organizational systems. 
             This attack differs from CAPEC-206, since the developer is inadvertently signing malicious code they believe to be legitimate and which they are unware of any malicious modifications.

Mitigations:
  - Have a security concept of operations (CONOPS) for the IDE that includes: Protecting the IDE via logical isolation using firewall and DMZ technologies/architectures; Maintaining strict security admini
  - Employ intrusion detection and malware detection capabilities on IDE systems where feasible.
MITRE CAPEC-674: Design for FPGA Maliciously Altered

Description:
An adversary alters the functionality of a field-programmable gate array (FPGA) by causing an FPGA configuration memory chip reload in order to introduce a malicious function that could result in the FPGA performing or enabling malicious functions on a host system. Prior to the memory chip reload, the adversary alters the program for the FPGA by adding a function to impact system operation.

Mitigations:
  - Utilize DMEA’s (Defense Microelectronics Activity) Trusted Foundry Program members for acquisition of microelectronic components.
  - Ensure that each supplier performing hardware development implements comprehensive, security-focused configuration management including for FPGA programming and program uploads to FPGA chips.
  - Require that provenance of COTS microelectronic components be known whenever procured.
MITRE CAPEC-675: Retrieve Data from Decommissioned Devices

Description:
An adversary obtains decommissioned, recycled, or discarded systems and devices that can include an organization’s intellectual property, employee data, and other types of controlled information. Systems and devices that have reached the end of their lifecycles may be subject to recycle or disposal where they can be exposed to adversarial attempts to retrieve information from internal memory chips and storage devices that are part of the system.

Mitigations:
  - Backup device data before erasure to retain intellectual property and inside knowledge.
  - Overwrite data on device rather than deleting. Deleted data can still be recovered, even if the device trash can is emptied. Rewriting data removes any trace of the old data. Performing multiple overw
  - Use a secure erase software.

Related CWEs: 1266
MITRE CAPEC-676: NoSQL Injection

Description:
An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authentication, and/or executing code.

Mitigations:
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as relevant NoSQL and JavaScript content. NoSQL-specific keywords, such as $ne, $eq 
  - If possible, leverage safe APIs (e.g., PyMongo and Flask-PyMongo for Python and MongoDB) for queries as opposed to building queries from strings.
  - Ensure the most recent version of a NoSQL database and it's corresponding API are used by the application.

Related CWEs: 943, 1286
MITRE CAPEC-677: Server Motherboard Compromise

Description:
Malware is inserted in a server motherboard (e.g., in the flash memory) in order to alter server functionality from that intended. The development environment or hardware/software support activity environment is susceptible to an adversary inserting malicious software into hardware components during development or update.

Mitigations:
  - Purchase IT systems, components and parts from government approved vendors whenever possible.
  - Establish diversity among suppliers.
  - Conduct rigorous threat assessments of suppliers.
MITRE CAPEC-678: System Build Data Maliciously Altered

Description:
During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system.

Mitigations:
  - Implement configuration management security practices that protect the integrity of software and associated data.
  - Monitor and control access to the configuration management system.
  - Harden centralized repositories against attack.
MITRE CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections

Description:
An adversary takes advantage of missing or incorrectly configured access control within memory to read/write data or inject malicious code into said memory.

Mitigations:
  - Ensure that protected and unprotected memory ranges are isolated and do not overlap.
  - If memory regions must overlap, leverage memory priority schemes if memory regions can overlap.
  - Ensure that original and mirrored memory regions apply the same protections.

Related CWEs: 1222, 1252, 1257, 1260, 1274, 1282, 1312, 1316, 1326
MITRE CAPEC-68: Subvert Code-signing Facilities

Description:
Many languages use code signing facilities to vouch for code's identity and to thus tie code to its assigned privileges within an environment. Subverting this mechanism can be instrumental in an attacker escalating privilege. Any means of subverting the way that a virtual machine enforces code signing classifies for this style of attack.

Mitigations:
  - A given code signing scheme may be fallible due to improper use of cryptography. Developers must never roll out their own cryptography, nor should existing primitives be modified or ignored.
  - If an attacker cannot attack the scheme directly, they might try to alter the environment that affects the signing and verification processes. A possible mitigation is to avoid reliance on flags or en

Related CWEs: 325, 328, 1326
MITRE CAPEC-680: Exploitation of Improperly Controlled Registers

Description:
An adversary exploits missing or incorrectly configured access control within registers to read/write data that is not meant to be obtained or modified by a user.

Mitigations:
  - Design proper access control policies for hardware register access from software and ensure these policies are implemented in accordance with the specified design.
  - Ensure security lock bit protections are reviewed for design inconsistencies and common weaknesses.
  - Test security lock programming flow in both pre-silicon and post-silicon environments.

Related CWEs: 1224, 1231, 1233, 1262, 1283
MITRE CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers

Description:
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.

Mitigations:
  - Review generation of security identifiers for design inconsistencies and common weaknesses.
  - Review security identifier decoders for design inconsistencies and common weaknesses.
  - Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.

Related CWEs: 1259, 1267, 1270, 1294, 1302
MITRE CAPEC-682: Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities

Description:
An adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with updatable devices, the manufacturer may decide not to support the device and stop making updates to their software.

Mitigations:
  - Design systems and products with the ability to patch firmware or ROM code after deployment to fix vulnerabilities.
  - Make use of OTA (Over-the-air) updates so that firmware can be patched remotely either through manual or automatic means

Related CWEs: 1277, 1310
MITRE CAPEC-69: Target Programs with Elevated Privileges

Description:
This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.

Mitigations:
  - Apply the principle of least privilege.
  - Validate all untrusted data.
  - Apply the latest patches.

Related CWEs: 250, 15
MITRE CAPEC-690: Metadata Spoofing

Description:
An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible.

Mitigations:
  - Validate metadata of resources such as authors, timestamps, and statistics.
  - Confirm the pedigree of open source packages and ensure the code being downloaded does not originate from another source.
  - Even if the metadata is properly checked and a user believes it to be legitimate, there may still be a chance that they've been duped. Therefore, leverage automated testing techniques to determine whe