COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-207

Removing Important Client Functionality

An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.

Extended description

Adversaries can, in some cases, get around logic put in place to 'guard' sensitive functionality or data. Client applications may include functionality that a server relies on for correct and secure operation. This functionality can include, but is not limited to, filters to prevent the sending of dangerous content to the server, logical functionality such as price calculations, and authentication logic to ensure that only authorized users are utilizing the client. If an adversary can disable this functionality on the client, they can perform actions that the server believes are prohibited. This can result in client behavior that violates assumptions by the server leading to a variety of possible attacks. In the above examples, this could include the sending of dangerous content (such as scripts) to the server, incorrect price calculations, or unauthorized access to server resources.

Execution flow

How does the attack proceed, step by step?

1

Explore

Probing

The adversary probes, through brute-forcing, reverse-engineering or other similar means, the functionality on the client that server assumes to be present and trustworthy.

Techniques used

  • The adversary probes by exploring an application's functionality and its underlying mapping to server-side components.
  • The adversary reverse engineers client-side code to identify the functionality that the server relies on for the proper or secure operation.
2

Experiment

Determine which functionality to disable or remove

The adversary tries to determine which functionality to disable or remove through reverse-engineering from the list of functionality identified in the Explore phase.

Techniques used

  • The adversary reverse engineers the client-side code to determine which functionality to disable or remove.
3

Exploit

Disable or remove the critical functionality from the client code

Once the functionality has been determined, the adversary disables or removes the critical functionality from the client code to perform malicious actions that the server believes are prohibited.

Techniques used

  • The adversary disables or removes the functionality from the client-side code to perform malicious actions, such as sending of dangerous content (such as scripts) to the server.

Requirements

What does the attack require?

Prerequisites

  • The targeted server must assume the client performs important actions to protect the server or the server functionality. For example, the server may assume the client filters outbound traffic or that the client performs all price calculations correctly. Moreover, the server must fail to detect when these assumptions are violated by a client.

Skills required

  • High: To reverse engineer the client-side code to disable/remove the functionality on the client that the server relies on.
  • Low: The adversary installs a web tool that allows scripts or the DOM model of web-based applications to be modified before they are executed in a browser. GreaseMonkey and Firebug are two examples of such tools.

Resources required

  • The adversary must have access to a client and be able to modify the client behavior, often through reverse engineering. If the server is assuming specific client functionality, this usually means the server only recognizes a specific client application, rather than a broad class of client applications. Reverse engineering tools would likely be necessary.

Impact

What does a successful attack lead to?

Other

Affected scopes: Confidentiality

Modify Data

Affected scopes: Integrity

Read Data

Affected scopes: Confidentiality

Gain Privileges

Affected scopes: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Affected scopes: Access Control, Authorization

Defence

How is it prevented and mitigated?

1
Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side.
2
Design: Ship client-side application with integrity checks (code signing) when possible.
3
Design: Use obfuscation and other techniques to prevent reverse engineering the client code.

Real world

MITRE example instances

Example instance 1Detail
The adversary reverse engineers a Java binary (by decompiling it) and identifies where license management code exists. Noticing that the license manager returns TRUE or FALSE as to whether or not the user is licensed, the adversary simply overwrites both branch targets to return TRUE, recompiles, and finally redeploys the binary.
Example instance 2Detail
The adversary uses click-through exploration of a Servlet-based website to map out its functionality, taking note of its URL-naming conventions and Servlet mappings. Using this knowledge and guessing the Servlet name of functionality they're not authorized to use, the adversary directly navigates to the privileged functionality around the authorizing single-front controller (implementing programmatic authorization checks).
CAPEC-207: Removing Important Client Functionality — DayBreach Saldırı Sözlüğü · DayBreach