MITRE ATT&CKsub-technique
T1474.001 Compromise Software Dependencies and Development Tools
- Domain
- mobile
- Tactics
- Initial Access
- Platforms
- Android, iOS
- Version
- 1.1
- Created
- 2022-03-28
Description
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1474 Supply Chain Compromise technique
Tactic · MITRE ATT&CK (1)
- TA0027 Initial Access tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1013 Application Developer Guidance mitigation
Referenced by MITRE ATT&CK · uses (1)
- S0297 XcodeGhost software (malware)
References
- https://dl.acm.org/doi/10.1145/2185448.2185464 Grace-Advertisement
- https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-6.html NIST Mobile Threat Catalogue
- https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-0.html NIST Mobile Threat Catalogue
- https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-3.html NIST Mobile Threat Catalogue
- https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-9.html NIST Mobile Threat Catalogue
- https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-10.html NIST Mobile Threat Catalogue
- https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-15.html NIST Mobile Threat Catalogue