Poisoned Pipeline / Techniques / T0190
Weak encryption
Cloud Security Infrastructure as code
A weak encryption attack in cloud security occurs when an attacker exploits vulnerabilities in the encryption mechanism used by a cloud service to gain unauthorized access to sensitive information.
This can happen when the encryption algorithm used by the cloud service is weak or when the encryption keys are not properly managed.
Where this idea came from
Velora SDK beaconed over plain HTTP; SleeperGem fetched payloads with certificate verification off. Also OWASP weak-crypto guidance.
- https://opensourcemalware.com/blog/velora-formerly-paraswap-sdk-version-941-compromised-and-installing-malware
- https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption
Mitigations
- M1241 Use strong encryption algorithms
- M1720 Implement regular patches and updates
Detections
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware