2. of Tampering (2022 deck) II
An attacker can modify your build system and produce signed builds of your software:
|
Threat |
|
|
|
Your laptop has been stolen and an attacker uses it to commit malicious code to a project in your code repository. |
|
CAPEC |
CAPEC-445: Malicious Logic Insertion into Product Software via Configuration Management Manipulation CAPEC-670: Software Development Tools Maliciously Altered CAPEC-511: Infiltration of Software Development Environment |
|
ASVS |
1.10.1: Verify the security and accountability of source code control 10.2.5: Ensure you are checking for malicious code in your code base |
|
CWE |
CWE-506: Embedded Malicious Code |
