COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-473

Signature Spoof

An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.

Requirements

What does the attack require?

Prerequisites

  • The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions.
  • The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature.

Skills required

  • High: Technical understanding of how signature verification algorithms work with data and applications

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Gain Privileges

Affected scopes: Access Control, Authentication

Real world

MITRE example instances

Example instance 1Detail
An attacker provides a victim with a malicious executable disguised as a legitimate executable from an established software by signing the executable with a forged cryptographic key. The victim's operating system attempts to verify the executable by checking the signature, the signature is considered valid, and the attackers' malicious executable runs.
Example instance 2Detail
An attacker exploits weaknesses in a cryptographic algorithm to that allow a private key for a legitimate software vendor to be reconstructed, attacker-created malicious software is cryptographically signed with the reconstructed key, and is installed by the victim operating system disguised as a legitimate software update from the software vendor.
CAPEC-473: Signature Spoof — DayBreach Saldırı Sözlüğü · DayBreach