CAPEC-691: Spoof Open-Source Software Metadata
An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.
Examples
An adversary provides a malicious open-source library, claiming to provide extended logging features and functionality, and spoofs the metadata with that of a widely used legitimate library. The adversary then tricks victims into including this library in their underlying application. Once the malicious software is incorporated into the application, the adversary is able to manipulate and exfiltrate log data.
Comment
We consider that this threat applies to scenarios where we consider adding a new dependency to our project, and a third-party may impersonate the original source. The problem of manipulating the integrity of an otherwise legitimate source is covered by CAPEC-439/CAPEC-444.
Requirements and Mitigations
Requirements
Component properties that must be true for this threat to apply:
Mitigations
Component properties that mitigate this threat:
Affected Components
No components affected by this threat.
Affected Scenarios
No scenarios affected by this threat.