CAPEC-532 Metadata
Likelihood of Attack
Low
Typical Severity
High
Overview
Summary
An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.
Prerequisites
Advanced knowledge about the installed target system design. Advanced knowledge about the download and update installation processes. Access to the download and update system(s) used to deliver BIOS images.
Potential Solutions / Mitigations
Deploy strong code integrity policies to allow only authorized apps to run. Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities. Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins. Require SSL for update channels and implement certificate transparency based verification. Sign update packages and BIOS patches. Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-444 | An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. These attacks generally require insider access to modify source code or to tamper with hardware components. The product is then delivered to the user where the negative impact can be leveraged at a later time. |
Taxonomy Mappings
Taxonomy: ATTACK
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.