Poisoned Pipeline / Techniques / T0196
Backdoor in code
Backdoor in code attack technique involves inserting a malicious code segment or backdoor into the software codebase, which allows the attacker to maintain access and control over the system even after their initial access has been removed or blocked.
In this attack, the attacker gains access to the codebase through various means, such as exploiting vulnerabilities or stealing credentials.
Once they have gained access, the attacker inserts a malicious code segment or backdoor into the codebase.
This code segment may be designed to execute specific malicious activities, such as stealing sensitive information, or to provide the attacker with continued access and control over the system.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1550 Implement strict access control for clouds
- M1731 Implement verification of signed commits
- M1732 Implement code scanning for security risks
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware