| ID | Name |
|---|---|
| T1195.001 | Compromise Software Dependencies and Development Tools |
| T1195.002 | Compromise Software Supply Chain |
| T1195.003 | Compromise Hardware Supply Chain |
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.[1] [2]
Angreifer können Anwendungssoftware manipulieren, bevor sie beim Endverbraucher ankommt, um Daten oder Systeme zu kompromittieren. Die Kompromittierung von Software in der Lieferkette kann auf verschiedene Weise erfolgen, z. B. durch Manipulation des Quellcodes der Anwendung, durch Manipulation des Update-/Verteilungsmechanismus für diese Software oder durch Ersetzen kompilierter Versionen durch eine modifizierte Version.
Das Targeting kann spezifisch auf eine gewünschte Opfergruppe ausgerichtet sein oder an eine breite Gruppe von Verbrauchern verteilt werden, aber nur bei bestimmten Opfern zu weiteren Taktiken übergehen.(Zitat: Avast CCleaner3 2018) (Zitat: Command Five SK 2011)
Les adversaires peuvent manipuler les logiciels d'application avant leur réception par un consommateur final dans le but de compromettre les données ou le système. La compromission de la chaîne d'approvisionnement d'un logiciel peut se faire de plusieurs façons, notamment par la manipulation du code source de l'application, la manipulation du mécanisme de mise à jour/distribution de ce logiciel, ou le remplacement des versions compilées par une version modifiée.
Le ciblage peut être spécifique à un ensemble de victimes souhaitées ou peut être distribué à un large ensemble de consommateurs mais ne passer à des tactiques supplémentaires que sur des victimes spécifiques.(Citation : Avast CCleaner3 2018) (Citation : Command Five SK 2011)
Gli avversari possono manipolare il software applicativo prima di riceverlo da un consumatore finale allo scopo di compromettere i dati o il sistema. La compromissione della catena di approvvigionamento del software può avvenire in vari modi, tra cui la manipolazione del codice sorgente dell'applicazione, la manipolazione del meccanismo di aggiornamento/distribuzione di quel software o la sostituzione di versioni compilate con una versione modificata.
Il targeting può essere specifico per un set di vittime desiderato o può essere distribuito a un ampio set di consumatori ma passare solo a tattiche aggiuntive su vittime specifiche.(Citazione: Avast CCleaner3 2018) (Citazione: Command Five SK 2011)
| ID | Name | Description |
|---|---|---|
| G0016 | APT29 |
APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.[3][4] |
| G0096 | APT41 |
APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.[5] |
| S0222 | CCBkdr |
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.[6][7][1] |
| G0080 | Cobalt Group |
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor. [8] |
| G0035 | Dragonfly |
Dragonfly has placed trojanized installers on legitimate vendor app stores.[9] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.[10][11][12] |
| S0493 | GoldenSpy |
GoldenSpy has been packaged with a legitimate tax preparation software.[13] |
| G0034 | Sandworm Team |
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.[14][15][16] |
| S0562 | SUNSPOT |
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.[17] |
| ID | Mitigation | Description |
|---|---|---|
| M1051 | Update Software |
A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation. |
| M1016 | Vulnerability Scanning |
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.[18] |
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.
Verwenden Sie die Überprüfung von verteilten Binärdateien durch Hash-Prüfung oder andere Mechanismen zur Integritätsprüfung. Scannen Sie Downloads auf bösartige Signaturen und versuchen Sie, Software und Updates vor der Bereitstellung zu testen, während Sie auf potenziell verdächtige Aktivitäten achten.
Utilisez la vérification des binaires distribués par le biais de la vérification du hachage ou d'autres mécanismes de vérification de l'intégrité. Analysez les téléchargements pour détecter les signatures malveillantes et essayez de tester les logiciels et les mises à jour avant leur déploiement tout en prenant note des activités suspectes potentielles.
Utilizzare la verifica dei binari distribuiti attraverso il controllo dell'hash o altri meccanismi di controllo dell'integrità. Esamini i download alla ricerca di firme dannose e cerchi di testare il software e gli aggiornamenti prima dello spiegamento, prendendo nota di potenziali attività sospette.