2108
Phase: Manufacturing
Ensure the unlock credentials are shared with the minimum number of parties and with utmost
secrecy. To limit the risk associated with compromised credentials, where possible, the
credentials should be part-specific.
Demonstrative Examples
Example 1:
This example shows how an attacker can take advantage of compromised credentials.
Example Language: (Bad)
Suppose a semiconductor chipmaker, "C", uses the foundry "F" for fabricating its chips. Now, F has many other customers
in addition to C, and some of the other customers are much smaller companies. F has dedicated teams for each of its
customers, but somehow it mixes up the unlock credentials and sends the unlock credentials of C to the wrong team. This
other team does not take adequate precautions to protect the credentials that have nothing to do with them, and eventually
the unlock credentials of C get leaked.
When the credentials of multiple organizations are stored together, exposure to third parties occurs
frequently.
Example Language: (Good)
Vertical integration of a production company is one effective method of protecting sensitive credentials. Where vertical
integration is not possible, strict access control and need-to-know are methods which can be implemented to reduce these
risks.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1195 Manufacturing and Life Cycle Management Concerns 1194 2469
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
560 Use of Known Domain Credentials
CWE-1274: Improper Access Control for Volatile Memory Containing Boot
Code
Weakness ID : 1274
Structure : Simple
Abstraction : Base
Description
The product conducts a secure-boot process that transfers bootloader code from Non-Volatile
Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other
protections for the Volatile Memory.
CWE Version 4.14
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code