CAPEC-678: System Build Data Maliciously Altered
During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system.
Last updated
Overview
CAPEC-678 (System Build Data Maliciously Altered) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- An adversary has access to the data files and processes used for executing system configuration and performing the build.
Consequences
What a successful CAPEC-678 attack can achieve.
Execute Unauthorized Commands
Affects: Integrity
Gain Privileges
Affects: Access Control
Modify Data, Read Data
Affects: Confidentiality
How to mitigate it
Defenses that reduce the risk of CAPEC-678.
- Implement configuration management security practices that protect the integrity of software and associated data.
- Monitor and control access to the configuration management system.
- Harden centralized repositories against attack.
- Establish acceptance criteria for configuration management check-in to assure integrity.
- Plan for and audit the security of configuration management administration processes.
- Maintain configuration control over operational systems.
Examples
‘Make’ is a program used for building executable programs and libraries from source code by executing commands and following rules in a ‘makefile’. It can create a malicious executable if commands or dependency paths in the makefile are maliciously altered to execute an unwanted command or reference as a dependency maliciously altered code.
Terminology & mappings
Mapped taxonomies
- ATTACK: Supply Chain Compromise: Compromise Software Supply Chain (1195.002)
Frequently asked questions
Common questions about CAPEC-678.
- What is CAPEC-678?
- During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system.
- How do you prevent CAPEC-678?
- Implement configuration management security practices that protect the integrity of software and associated data.
- How severe is CAPEC-678?
- MITRE rates CAPEC-678 as High severity with low likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-678
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.