deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation

Description:
An adversary exploits a configuration management system so that malicious logic is inserted into a software products build, update or deployed environment. If an adversary can control the elements included in a product's configuration management for build they can potentially replace, modify or insert code files containing malicious logic. If an adversary can control elements of a product's ongoing operational configuration management baseline they can potentially force clients receiving updates from the system to install insecure software when receiving updates from the server.

Mitigations:
  - Assess software during development and prior to deployment to ensure that it functions as intended and without any malicious functionality.
  - Leverage anti-virus products to detect and quarantine software with known virus.
MITRE CAPEC-446: Malicious Logic Insertion into Product via Inclusion of Third-Party Component

Description:
An adversary conducts supply chain attacks by the inclusion of insecure third-party components into a technology, product, or code-base, possibly packaging a malicious driver or component along with the product before shipping it to the consumer or acquirer.

Mitigations:
  - Assess software and hardware during development and prior to deployment to ensure that it functions as intended and without any malicious functionality. This includes both initial development, as well
  - Don't assume popular third-party components are free from malware or vulnerabilities. For software, assess for malicious functionality via update/commit reviews or automated static/dynamic analysis pr
MITRE CAPEC-447: Design Alteration

Description:
An adversary modifies the design of a technology, product, or component to acheive a negative impact once the system is deployed. In this type of attack, the goal of the adversary is to modify the design of the system, prior to development starting, in such a way that the negative impact can be leveraged when the system is later deployed. Design alteration attacks differ from development alteration attacks in that design alteration attacks take place prior to development and which then may or may not be developed by the adverary. Design alteration attacks include modifying system designs to degrade system performance, cause unexpected states or errors, and general design changes that may lead to additional vulnerabilities. These attacks generally require insider access to modify design documents, but they may also be spoofed via web communications. The product is then developed and delivered to the user where the negative impact can be leveraged at a later time.

Mitigations:
  - Assess design documentation prior to development to ensure that they function as intended and without any malicious functionality.
  - Ensure that design documentation is saved in a secure location and has proper access controls set in place to avoid unnecessary modification.
MITRE CAPEC-448: Embed Virus into DLL

Description:
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.

Mitigations:
  - Leverage anti-virus products to detect and quarantine software with known virus.

Related CWEs: 506
MITRE CAPEC-45: Buffer Overflow via Symbolic Links

Description:
This type of attack leverages the use of symbolic links to cause buffer overflows. An adversary can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.

Mitigations:
  - Pay attention to the fact that the resource you read from can be a replaced by a Symbolic link. You can do a Symlink check before reading the file and decide that this is not a legitimate way of acces
  - Because Symlink can be modified by an adversary, make sure that the ones you read are located in protected directories.
  - Pay attention to the resource pointed to by your symlink links (See attack pattern named "Forced Symlink race"), they can be replaced by malicious resources.

Related CWEs: 120, 285, 302, 118, 119, 74, 20, 680, 697
MITRE CAPEC-452: Infected Hardware

Description:
An adversary inserts malicious logic into hardware, typically in the form of a computer virus or rootkit. This logic is often hidden from the user of the hardware and works behind the scenes to achieve negative impacts. This pattern of attack focuses on hardware already fielded and used in operation as opposed to hardware that is still under development and part of the supply chain.
MITRE CAPEC-456: Infected Memory

Description:
An adversary inserts malicious logic into memory enabling them to achieve a negative impact. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems that are still under development and part of the supply chain.

Mitigations:
  - Leverage anti-virus products to detect stop operations with known virus.

Related CWEs: 1257, 1260, 1274, 1312, 1316
MITRE CAPEC-457: USB Memory Attacks

Description:
An adversary loads malicious code onto a USB memory stick in order to infect any system which the device is plugged in to. USB drives present a significant security risk for business and government agencies. Given the ability to integrate wireless functionality into a USB stick, it is possible to design malware that not only steals confidential data, but sniffs the network, or monitor keystrokes, and then exfiltrates the stolen data off-site via a Wireless connection. Also, viruses can be transmitted via the USB interface without the specific use of a memory stick. The attacks from USB devices are often of such sophistication that experts conclude they are not the work of single individuals, but suggest state sponsorship. These attacks can be performed by an adversary with direct access to a target system or can be executed via means such as USB Drop Attacks.

Mitigations:
  - Ensure that proper, physical system access is regulated to prevent an adversary from physically connecting a malicious USB device themself.
  - Use anti-virus and anti-malware tools which can prevent malware from executing if it finds its way onto a target system. Additionally, make sure these tools are regularly updated to contain up-to-date
  - Do not connect untrusted USB devices to systems connected on an organizational network. Additionally, use an isolated testing machine to validate untrusted devices and confirm malware does not exist.

Related CWEs: 1299
MITRE CAPEC-458: Flash Memory Attacks

Description:
An adversary inserts malicious logic into a product or technology via flashing the on-board memory with a code-base that contains malicious logic. Various attacks exist against the integrity of flash memory, the most direct being rootkits coded into the BIOS or chipset of a device.

Related CWEs: 1282
MITRE CAPEC-459: Creating a Rogue Certification Authority Certificate

Description:
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.

Mitigations:
  - Certification Authorities need to stop using deprecated or cryptographically insecure hashing algorithms to hash the certificates that they are about to sign. Instead they should be using stronger has

Related CWEs: 327, 295, 290
MITRE CAPEC-46: Overflow Variables and Tags

Description:
This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The adversary crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.

Mitigations:
  - Use a language or compiler that performs automatic bounds checking.
  - Use an abstraction library to abstract away risky APIs. Not a complete solution.
  - Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.

Related CWEs: 120, 118, 119, 74, 20, 680, 733, 697
MITRE CAPEC-460: HTTP Parameter Pollution (HPP)

Description:
An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.

Mitigations:
  - Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests
  - Design: Perform URL encoding
  - Implementation: Use strict regular expressions in URL rewriting

Related CWEs: 88, 147, 235
MITRE CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness

Description:
An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.

Mitigations:
  - Design: Use a secure message authentication code (MAC) function such as an HMAC-SHA1

Related CWEs: 328, 290
MITRE CAPEC-462: Cross-Domain Search Timing

Description:
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.

Mitigations:
  - Design: The victim's site could protect all potentially sensitive functionality (e.g. search functions) with cross site request forgery (CSRF) protection and not perform any work on behalf of forged r
  - Design: The browser's security model could be fixed to not leak timing information for cross domain requests

Related CWEs: 385, 352, 208
MITRE CAPEC-463: Padding Oracle Crypto Attack

Description:
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.

Mitigations:
  - Design: Use a message authentication code (MAC) or another mechanism to perform verification of message authenticity / integrity prior to decryption
  - Implementation: Do not leak information back to the user as to any cryptography (e.g., padding) encountered during decryption.

Related CWEs: 209, 514, 649, 347, 354, 696
MITRE CAPEC-464: Evercookie

Description:
An attacker creates a very persistent cookie that stays present even after the user thinks it has been removed. The cookie is stored on the victim's machine in over ten places. When the victim clears the cookie cache via traditional means inside the browser, that operation removes the cookie from certain places but not others. The malicious code then replicates the cookie from all of the places where it was not deleted to all of the possible storage locations once again. So the victim again has the cookie in all of the original storage locations. In other words, failure to delete the cookie in even one location will result in the cookie's resurrection everywhere. The evercookie will also persist across different browsers because certain stores (e.g., Local Shared Objects) are shared between different browsers.

Mitigations:
  - Design: Browser's design needs to be changed to limit where cookies can be stored on the client side and provide an option to clear these cookies in all places, as well as another option to stop these
  - Design: Safari browser's private browsing mode is currently effective against evercookies.

Related CWEs: 359
MITRE CAPEC-465: Transparent Proxy Abuse

Description:
A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.

Mitigations:
  - Design: Ensure that the transparent proxy uses an actual network layer IP address for routing requests. On the transparent proxy, disable the use of routing based on address information in the HTTP ho
  - Configuration: Disable in the browser the execution of Java Script, Flash, SilverLight, etc.

Related CWEs: 441
MITRE CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy

Description:
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.

Mitigations:
  - Design: Tunnel communications through a secure proxy
  - Design: Trust level separation for privileged / non privileged interactions (e.g., two different browsers, two different users, two different operating systems, two different virtual machines)

Related CWEs: 300
MITRE CAPEC-467: Cross Site Identification

Description:
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).

Mitigations:
  - Usage: Users should always explicitly log out from the social networking sites when done using them.
  - Usage: Users should not open other tabs in the browser when using a social networking site.

Related CWEs: 352, 359
MITRE CAPEC-468: Generic Cross-Browser Cross-Domain Theft

Description:
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.

Mitigations:
  - Design: Prior to performing CSS parsing, require the CSS to start with well-formed CSS when it is a cross-domain load and the MIME type is broken. This is a browser level fix.
  - Implementation: Perform proper HTML encoding and URL escaping

Related CWEs: 707, 149, 177, 838
MITRE CAPEC-469: HTTP DoS

Description:
An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.

Mitigations:
  - Configuration: Configure web server software to limit the waiting period on opened HTTP sessions
  - Design: Use load balancing mechanisms

Related CWEs: 770, 772
MITRE CAPEC-47: Buffer Overflow via Parameter Expansion

Description:
In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.

Mitigations:
  - Ensure that when parameter expansion happens in the code that the assumptions used to determine the resulting size of the parameter are accurate and that the new size of the parameter is visible to th

Related CWEs: 120, 119, 118, 130, 131, 74, 20, 680, 697
MITRE CAPEC-470: Expanding Control over the Operating System from the Database

Description:
An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.

Mitigations:
  - Design: Follow the defensive programming practices needed to protect an application accessing the database from SQL injection
  - Configuration: Ensure that the DBMS is patched with the latest security patches
  - Design: Ensure that the DBMS login used by the application has the lowest possible level of privileges in the DBMS

Related CWEs: 250, 89
MITRE CAPEC-471: Search Order Hijacking

Description:
An adversary exploits a weakness in an application's specification of external libraries to exploit the functionality of the loader where the process loading the library searches first in the same directory in which the process binary resides and then in other directories. Exploitation of this preferential search order can allow an attacker to make the loading process load the adversary's rogue library rather than the legitimate library. This attack can be leveraged with many different libraries and with many different loading processes. No forensic trails are left in the system's registry or file system that an incorrect library had been loaded.

Mitigations:
  - Design: Fix the Windows loading process to eliminate the preferential search order by looking for DLLs in the precise location where they are expected
  - Design: Sign system DLLs so that unauthorized DLLs can be detected.

Related CWEs: 427
MITRE CAPEC-472: Browser Fingerprinting

Description:
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.

Mitigations:
  - Configuration: Disable Java Script in the browser

Related CWEs: 200
MITRE CAPEC-473: Signature Spoof

Description:
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.

Related CWEs: 20, 327, 290
MITRE CAPEC-474: Signature Spoofing by Key Theft

Description:
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Mitigations:
  - Restrict access to private keys from non-supervisory accounts
  - Restrict access to administrative personnel and processes only
  - Ensure all remote methods are secured

Related CWEs: 522
MITRE CAPEC-475: Signature Spoofing by Improper Validation

Description:
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

Mitigations:
  - Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.

Related CWEs: 347, 327, 295
MITRE CAPEC-476: Signature Spoofing by Misrepresentation

Description:
An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.

Mitigations:
  - Ensure the application is using parsing and data display techniques that will accurately display control characters, international symbols and markings, and ultimately recognize potential homograph at

Related CWEs: 290
MITRE CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content

Description:
An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.

Mitigations:
  - Ensure the application is fully patched and does not allow the processing of unsigned data as if it is signed data.

Related CWEs: 693, 311, 319
MITRE CAPEC-478: Modification of Windows Service Configuration

Description:
An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.

Mitigations:
  - Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

Related CWEs: 284