CAPEC-530: Provide Counterfeit Component
Description
An attacker provides a counterfeit component during the procurement process of a lower-tier component supplier to a sub-system developer or integrator, which is then built into the system being upgraded or repaired by the victim, allowing the attacker to cause disruption or additional compromise.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Advanced knowledge about the target system and sub-components.
Skills required
- HighAble to develop and manufacture malicious system components that resemble legitimate name-brand components.
Mitigations
- There are various methods to detect if the component is a counterfeit. See section II of for many techniques.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.