Poisoned Pipeline / Incidents / AS243

AS243 · 2012-11

OpenX Source archive backdoored

Git / GitHub

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://www.clearmind.cc/2013/08/backdoor-found-in-openx-open-source-version-2-8-10-some-thoughts/
• https://seclists.org/oss-sec/2013/q3/295
• https://www.cisa.gov/news-events/alerts/2013/08/08/openx-releases-security-update
• https://arstechnica.com/information-technology/2013/08/backdoor-in-popular-ad-serving-software-opens-websites-to-remote-hijacking/
• https://www.tenable.com/plugins/nessus/69371
• https://blog.sucuri.net/2013/12/openx-compromise-serving-malware.html