CAPEC-521: Hardware Design Specifications Are Altered
Description
An attacker with access to a manufacturer's hardware manufacturing process documentation alters the design specifications, which introduces flaws advantageous to the attacker once the system is deployed.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Advanced knowledge of hardware capabilities of a manufacturer's product.
- Access to the manufacturer's documentation.
Skills required
- HighAbility to read, interpret, and subsequently alter manufacturer's documentation to cause errors in design specifications.
- HighAbility to stealthly gain access via remote compromise or physical access to the manufacturer's documentation.
Mitigations
- Digitize documents and cryptographically sign them to verify authenticity.
- Password protect documents and make them read-only for unauthorized users.
- Avoid emailing important documents and configurations.
- Ensure deleted files are actually deleted.
- Maintain backups of the document for recovery and verification.
- Separate need-to-know information from system configuration information depending on the user.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.