CAPEC-638: Altered Component Firmware
Description
An adversary exploits systems features and/or improperly protected firmware of hardware components, such as Hard Disk Drives (HDD), with the goal of executing malicious code from within the component's Master Boot Record (MBR). Conducting this type of attack entails the adversary infecting the target with firmware altering malware, using known tools, and a payload. Once this malware is executed, the MBR is modified to include instructions to execute the payload at desired intervals and when the system is booted up. A successful attack will obtain persistence within the victim system even if the operating system is reinstalled and/or if the component is formatted or has its data erased.
- Likelihood of attack
- Low
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Advanced knowledge about the target component's firmware
- Advanced knowledge about Master Boot Records (MBR)
- Advanced knowledge about tools used to insert firmware altering malware.
- Advanced knowledge about component shipments to the target organization.
Skills required
- HighAbility to access and reverse engineer hardware component firmware.
- HighAbility to intercept components in transit.
- MediumAbility to create malicious payload to be executed from MBR.
- LowAbility to leverage known malware tools to infect target system and insert firmware altering malware/payload
Consequences
- AuthenticationAuthorization
Gain Privileges; Execute Unauthorized Commands; Bypass Protection Mechanism; Hide Activities
- ConfidentialityAccess Control
Read Data; Modify Data
Mitigations
- Leverage hardware components known to not be susceptible to these types of attacks.
- Implement hardware RAID infrastructure.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-BABootloader Authentication1 shared
- D3-SFVSystem Firmware Verification1 shared
- D3-FBAFirmware Behavior Analysis1 shared
- D3-FEMCFirmware Embedded Monitoring Code1 shared
- D3-FVFirmware Verification1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared
- D3-SUSoftware Update1 shared
- D3-APCAApplication Protocol Command Analysis1 shared
- D3-CSPPClient-server Payload Profiling1 shared
- D3-NTCDNetwork Traffic Community Deviation1 shared