1216
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Automated Monitored Execution Forced Path Execution Debugger Monitored Virtual
Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does
anything suspicious
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Context-configured Source Code Weakness Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Cost
effective for partial coverage: Formal Methods / Correct-By-Construction
Effectiveness = High
Potential Mitigations
Phase: Installation
Always verify the integrity of the software that is being installed.
Phase: Testing
Identify and closely inspect the conditions for entering privileged areas of the code, especially
those related to authentication, process invocation, and network communications.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 904 SFP Primary Cluster: Malware 888 2387
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Landwehr Trapdoor
CWE-511: Logic/Time Bomb
Weakness ID : 511
Structure : Simple
Abstraction : Base
Description
The product contains code that is designed to disrupt the legitimate operation of the product (or its
environment) when a certain time passes, or when a certain logical condition is met.
CWE Version 4.14
CWE-511: Logic/Time Bomb
CWE-511: Logic/Time Bomb