CAPEC-691: Spoof Open-Source Software Metadata
Description
An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- Identification of a popular open-source component whose metadata is to be spoofed.
Skills required
- MediumAbility to spoof a variety of software metadata to convince victims the source is trusted.
Consequences
- Integrity
Modify Data
- Accountability
Hide Activities
- Access ControlAuthorization
Execute Unauthorized Commands; Alter Execution Logic; Gain Privileges
Mitigations
- Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged.
- Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
- Reference vulnerability databases to determine if the software contains known vulnerabilities.
- Only download open-source software from reputable hosting sites or package managers.
- Only download open-source software that has been adequately signed by the developer(s). For repository commits/tags, look for the Verified status and for developers leveraging Vigilant Mode (GitHub) or similar modes.
- After downloading open-source software, ensure integrity values have not changed.
- Before executing or incorporating the software, leverage automated testing techniques (e.g., static and dynamic analysis) to determine if the software behaves maliciously.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.