CAPEC-439: Manipulation During Distribution
An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging.
Examples
A malicious OEM provider, or OEM provider employee or contractor, may install software, or modify existing code, during distribution.::External contractors involved in the packaging or testing of products or components may install software, or modify existing code, during distribution.
Comment
This CAPEC threat basically is about points in the supply chain where they might be exposed to attackers. To mitigate this threat, we must be able to verify the data that passes through them.
Requirements and Mitigations
Requirements
Component properties that must be true for this threat to apply:
Mitigations
Component properties that mitigate this threat:
Affected Components
| Component | Description | Boundary |
|---|---|---|
| GitHub release server | Internet | |
| dangerzone.rocks | Official Dangerzone website | Internet |
| External github repositories | Internet |