| ID | Name |
|---|---|
| T1474.001 | Compromise Software Dependencies and Development Tools |
| T1474.002 | Compromise Hardware Supply Chain |
| T1474.003 | Compromise Software Supply Chain |
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
| ID | Name | Description |
|---|---|---|
| S0309 | Adups |
Adups was pre-installed on Android devices from some vendors.[1][2] |
| S0319 | Allwinner |
A Linux kernel distributed by Allwinner reportedly contained an simple backdoor that could be used to obtain root access. It was believed to have been left in the kernel by mistake by the authors.[3] |
| S0555 | CHEMISTGAMES |
CHEMISTGAMES has been distributed as updates to legitimate applications. This was accomplished by compromising legitimate app developers, and subsequently gaining access to their Google Play Store developer account.[4] |
| S0328 | Stealth Mango |
In at least one case, Stealth Mango may have been installed using physical access to the device by a repair shop.[5] |
| S0424 | Triada |
Triada was added into the Android system by a third-party vendor identified as Yehuo or Blazefire during the production process.[6][7] |
| ID | Mitigation | Description |
|---|---|---|
| M1001 | Security Updates |
Security updates may contain patches that inhibit system software compromises. |
| M1004 | System Partition Integrity |
Ensure Verified Boot is enabled on devices with that capability. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0721 | Detection of Compromise Software Supply Chain | AN1853 |
For Android, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: Compromised app writes staging, cache, or export artifacts inconsistent with its declared function within $PostInstallWindow$]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1854 |
For iOS, detect Compromise Software Supply Chain from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Launch services, extension-handling, or framework subsystem anomalies occur near install or first launch of recently updated trusted app on supervised device]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |