CAPEC Definitions / CAPEC-522
CAPEC-522: Malicious Hardware Component Replacement
An adversary replaces legitimate hardware in the system with faulty counterfeit or tampered hardware in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.
Extended Description
No Extended Description.
Mitigations
Ensure that all contractors and sub-suppliers use trusted means of shipping (e.g., bonded/cleared/vetted and insured couriers) to ensure that components, once purchased, are not subject to compromise during their delivery.
Prevent or detect tampering with critical hardware or firmware components while in transit through use of state-of-the-art anti-tamper devices.
Use tamper-resistant and tamper-evident packaging when shipping critical components (e.g., plastic coating for circuit boards, tamper tape, paint, sensors, and/or seals for cases and containers) and inspect received system components for evidence of tampering.
Relationships with other CAPECs
CAPEC-439: Manipulation During Distribution
Prerequisites
Physical access to the system after it has left the manufacturer but before it is deployed at the victim location.
Related Weaknesses
No related Weaknesses found.
