2. of Elevation of Privilege (2022 deck)

An attacker has compromised a key technology supplier.

Threat
	The company that writes your order processing system has been hacked and the attackers have written a backdoor into the latest version and you have configured automatic updates. So, they can now steal/exfiltrate all your customer data.
CAPEC	CAPEC-523 – Malicious software implanted CAPEC-511 – Infiltration of the software development environment CAPEC-657 – Malicious automated software update via spoofing
ASVS	10.2.1 – Check for application phoning home and harvesting of data 10.2.3 – Check source for backdoors and other malicious code 10.3.1 – Check that automatic updates are signed and performed...