COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-474

Signature Spoofing by Key Theft

An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Requirements

What does the attack require?

Prerequisites

  • An authoritative or reputable signer is storing their private signature key with insufficient protection.

Skills required

  • Low: Knowledge of common location methods and access methods to sensitive data
  • High: Ability to compromise systems containing sensitive data

Resources required

Not stated in the MITRE record.

Defence

How is it prevented and mitigated?

1
Restrict access to private keys from non-supervisory accounts
2
Restrict access to administrative personnel and processes only
3
Ensure all remote methods are secured
4
Ensure all services are patched and up to date
CAPEC-474: Signature Spoofing by Key Theft — DayBreach Saldırı Sözlüğü · DayBreach