CAPEC-516: Hardware Component Substitution During Baselining

Description

An adversary with access to system components during allocated baseline development can substitute a maliciously altered hardware component for a baseline component during the product development and research phases. This can lead to adjustments and calibrations being made in the product so that when the final product, now containing the modified component, is deployed it will not perform as designed and be advantageous to the adversary.

Extended Description

WS-Addressing is used to virtualize services, provide return addresses and other routing information, however, unless the WS-Addressing headers are protected they are vulnerable to rewriting. Content in a registry is deployed by the service provider. The registry in an SOA or Web Services system can be accessed by the service requester via UDDI or other protocol.

Severity :

High

Possibility :

Low

Type :

Detailed

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-444: Development Alteration Development Alteration

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The adversary will need either physical access or be able to supply malicious hardware components to the product development facility.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Medium Intelligence data on victim's purchasing habits.
High Resources to maliciously construct/alter hardware components used for testing by the supplier.
High Resources to physically infiltrate supplier.

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

ATTACK | Supply Chain Compromise: Compromise Hardware Supply Chain

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

Visit http://capec.mitre.org/ for more details.