软件开发人员可以直接引用一个风投公司库(即。,via a hardcoded URL) within source code to integrate the repository as a dependency for the underlying application. If the repository owner/maintainer modifies the repository name, changes their VCS username, or transfers ownership of the repository, the VCS implements a redirect to the new repository location so that existing software referencing the repository will not break. However, if the original location of the repository is reestablished, the VCS will revert to resolving the hardcoded path. Adversaries may, therefore, re-register deleted or previously used usernames and recreate repositories with malicious code to infect applications referencing the repository. When an application then fetches the desired dependency, it will now reference the adversary's malicious repository since the hardcoded repository path is once again active. This ultimately allows the adversary to infect numerous applications, while achieving a variety of negative technical impacts.
创建初始库路径:敌人重新注册的帐户被命名为/删除目标库的所有者/维护者和再现目标与恶意代码库旨在开发一个应用程序。这些步骤可能需要发生反向(即。,recreate repository and then rename an existing account to the target account) if protections are in place to prevent repository reuse.
实现(即“供应商”。,including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously.
描述
此表显示了其他的攻击模式和高水平类别相关的这种攻击模式。这些关系被定义为ChildOf ParentOf,给类似的项目可能存在的洞察力在较高和较低的抽象级别。此外,关系如光束,PeerOf, CanAlsoBe定义显示类似的攻击模式,用户可能想要探索。
内容的历史
