CAPEC-186: Malicious Software Update
An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source.
Last updated
Overview
Although there are several variations to this strategy of attack, the attack methods are united in that all rely on the ability of an adversary to position and disguise malicious content such that it masquerades as a legitimate software update which is then processed by a program, undermining application integrity. As such the attack employs 'spoofing' techniques augmented by psychological or technological mechanisms to disguise the update and/or its source. Virtually all software requires frequent updates or patches, giving the adversary immense latitude when structuring the attack, as well as many targets of opportunity. Automated attacks involving malicious software updates require little to no user-directed activity and are therefore advantageous because they avoid the complex preliminary setup stages of manual attacks, which must effectively 'hook' users while avoiding countermeasures such as spam filters or web security filters.
How the attack works
The phases an attacker typically follows.
- Step 1Explore
[Identify target] The adversary must first identify what they want their target to be. Because malicious software updates can be carried out in a variety of ways, the adversary will first not only identify a target program, but also what users they wish to target. This attack can be targeted (a particular user or group of users) or untargeted (many different users).
- Step 2Experiment
[Craft a deployment mechanism based on the target] The adversary must craft a deployment mechanism to deploy the malicious software update. This mechanism will differ based on if the attack is targeted or untargeted.
- Targeted attack: hosting what appears to be a software update, then harvesting actual email addresses for an organization, or generating commonly used email addresses, and then sending spam, phishing, or spear-phishing emails to the organization's users requesting that they manually download and install the malicious software update.
- Targeted attack: Instant Messaging virus payload, which harvests the names from a user's contact list and sends instant messages to those users to download and apply the update
- Untargeted attack: Spam the malicious update to as many users as possible through unsolicited email, instant messages, or social media messages.
- Untargeted attack: Send phishing emails to as many users as possible and pretend to be a legitimate source suggesting to download an important software update.
- Untargeted attack: Use trojans/botnets to aid in either of the two untargeted attacks.
- Step 3Exploit
[Deploy malicious software update] Using the deployment mechanism from the previous step, the adversary gets a user to install the malicious software update.
What the attacker needs
Skills required
- High skill: This attack requires advanced cyber capabilities
Resources required
- Manual or user-assisted attacks require deceptive mechanisms to trick the user into clicking a link or downloading and installing software. Automated update attacks require the adversary to host a payload and then trigger the installation of the payload code.
Consequences
What a successful CAPEC-186 attack can achieve.
Execute Unauthorized Commands
Affects: Access Control, Availability, Confidentiality
Utilize the built-in software update mechanisms of the commercial components to deliver software that could compromise security credentials, enable a denial-of-service attack, or enable tracking.
How to mitigate it
Defenses that reduce the risk of CAPEC-186.
- Validate software updates before installing.
Examples
Using an automated process to download and install dangerous code was key part of the NotPeyta attack [REF-697]
Terminology & mappings
Mapped taxonomies
- ATTACK: Supply Chain Compromise: Compromise Software Supply Chain (1195.002)
Frequently asked questions
Common questions about CAPEC-186.
- What is CAPEC-186?
- An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source.
- How does a Malicious Software Update attack work?
- It typically unfolds over 3 phases. It begins with: [Identify target] The adversary must first identify what they want their target to be. Because malicious software updates can be carried out in a variety of ways, the adversary will first not only identify a target program, but also what users they wish to target. This attack can be targeted (a particular user or group of users) or untargeted (many different users).
- How do you prevent CAPEC-186?
- Validate software updates before installing.
- What weaknesses does CAPEC-186 target?
- CAPEC-186 exploits 1 CWE weakness, including CWE-494 (Download of Code Without Integrity Check).
- How severe is CAPEC-186?
- MITRE rates CAPEC-186 as High severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-186
Track the CVEs and weaknesses this technique exploits, with AI-written analysis and remediation steps.