File size: 4,040 Bytes
5fe70fd |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
{
"id": "bundle--e26b8616-972a-47ce-bee1-2c335e9181c6",
"objects": [
{
"created": "2014-06-23T00:00:00.000Z",
"created_by_ref": "identity--e50ab59c-5c4f-4d40-bf6a-d58418d89bcd",
"description": "An attacker modifies a technology, product, or component during a stage in its manufacture for the purpose of carrying out an attack against some entity involved in the supply chain lifecycle. There are an almost limitless number of ways an attacker can modify a technology when they are involved in its manufacture, as the attacker has potential inroads to the software composition, hardware design and assembly, firmware, or basic design mechanics. Additionally, manufacturing of key components is often outsourced with the final product assembled by the primary manufacturer. The greatest risk, however, is deliberate manipulation of design specifications to produce malicious hardware or devices. There are billions of transistors in a single integrated circuit and studies have shown that fewer than 10 transistors are required to create malicious functionality.",
"external_references": [
{
"external_id": "CAPEC-438",
"source_name": "capec",
"url": "https://capec.mitre.org/data/definitions/438.html"
},
{
"description": "Supply Chain Compromise",
"external_id": "T1195",
"source_name": "ATTACK",
"url": "https://attack.mitre.org/wiki/Technique/T1195"
},
{
"description": "Jon Boyens, Angela Smith, Nadya Bartol, Kris Winkler, Alex Holbrook, Matthew Fallon, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2nd Draft), 2021--10---28, National Institute of Standards and Technology (NIST)",
"external_id": "REF-379",
"source_name": "reference_from_CAPEC",
"url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-draft2.pdf"
},
{
"description": "Marcus Sachs, Supply Chain Attacks: Can We Secure Information Technology Supply Chain in the Age of Globalization, Verizon, Inc.",
"external_id": "REF-380",
"source_name": "reference_from_CAPEC"
},
{
"description": "Thea Reilkoff, Hardware Trojans: A Novel Attack Meets a New Defense, 2010, Yale School of Engineering and Applied Science",
"external_id": "REF-381",
"source_name": "reference_from_CAPEC"
},
{
"description": "Marianne Swanson, Nadya Bartol, Rama Moorthy, Piloting Supply Chain Risk Management Practices for Federal Information Systems (Draft NISTIR 7622), 2010, National Institute of Standards and Technology",
"external_id": "REF-382",
"source_name": "reference_from_CAPEC"
}
],
"id": "attack-pattern--1339dbbe-fe41-467a-b43c-7d56d22a9fe4",
"modified": "2021-06-24T00:00:00.000Z",
"name": "Modification During Manufacture",
"object_marking_refs": [
"marking-definition--17d82bb2-eeeb-4898-bda5-3ddbcd2b799d"
],
"spec_version": "2.1",
"type": "attack-pattern",
"x_capec_abstraction": "Meta",
"x_capec_domains": [
"Supply Chain",
"Software",
"Hardware"
],
"x_capec_parent_of_refs": [
"attack-pattern--efb74200-657d-438c-aaff-bbd9644dd72d",
"attack-pattern--cf550376-63ac-4b46-87d1-0e324c1c1c46"
],
"x_capec_status": "Draft",
"x_capec_version": "3.9"
}
],
"type": "bundle"
} |