CAPEC-519: Documentation Alteration to Cause Errors in System Design
Description
An attacker with access to a manufacturer's documentation containing requirements allocation and software design processes maliciously alters the documentation in order to cause errors in system design. This allows the attacker to take advantage of a weakness in a deployed system of the manufacturer for malicious purposes.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Advanced knowledge of software capabilities of a manufacturer's product.
- Access to the manufacturer's documentation.
Skills required
- HighAbility to read, interpret, and subsequently alter manufacturer's documentation to cause errors in system design.
- HighAbility to stealthly gain access via remote compromise or physical access to the manufacturer's documentation.
Mitigations
- Digitize documents and cryptographically sign them to verify authenticity.
- Password protect documents and make them read-only for unauthorized users.
- Avoid emailing important documents and configurations.
- Ensure deleted files are actually deleted.
- Maintain multiple instances of the document across different privileged users for recovery and verification.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.