Trapdoor

Opis

A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.

Skutki

• Confidentiality, Integrity, Availability, Access Control

  Execute Unauthorized Code or Commands; Bypass Protection Mechanism

Zapobieganie

• Installation

  Always verify the integrity of the software that is being installed.

• Testing

  Identify and closely inspect the conditions for entering privileged areas of the code, especially those related to authentication, process invocation, and network communications.

Słabość nadrzędna

• CWE-506 Embedded Malicious Code

Kiedy powstaje

• Architecture and Design
• Implementation
• Distribution
• Operation

Dotyczy

Not Language-Specific

Uwagi

It is suspected that malicious code can often be characterized using other "regular" weaknesses related to insecure behavior. However, this has not been closely investigated.

Źródła

1. A Taxonomy of Computer Program Security Flaws, with Examples — Carl E. Landwehr, Alan R. Bull, John P. McDermott, William S. Choi, 1993
2. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014