CAPEC 690 Metadata Spoofing

Description

🇬🇧 English Original 🇮🇹 Italiano AI Translated

{'xhtml:p': 'An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible.'}

AI Generated Translation

{"xhtml:p": "Un avversario modifica i metadati di una risorsa (ad esempio, file, directory, repository, ecc.) per presentare una risorsa dannosa come legittima/credibile."}

Mitigations

3

Confirm The Pedigree Of Open Source Packages And Ensure The Code Being Downloaded Does Not Originate From Another Source.

Even If The Metadata Is Properly Checked And A User Believes It To Be Legitimate, There May Still Be A Chance That They'Ve Been Duped. Therefore, Leverage Automated Testing Techniques To Determine Where Malicious Areas Of The Code May Exist.

Validate Metadata Of Resources Such As Authors, Timestamps, And Statistics.

Consequences

Security Scopes Affected

Access Control Accountability Authorization Integrity

Potential Impacts

Execute Unauthorized Commands Hide Activities Modify Data

Relationships

Child CAPECs

CAPEC-691 Spoof Open-Source Software Metadata