COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-508

Shoulder Surfing

In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content "over the victim's shoulder", as implied by the name of this attack.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content "over the victim's shoulder", as implied by the name of this attack.

Requirements

What does the attack require?

Prerequisites

  • The adversary typically requires physical proximity to the target's environment, in order to observe their screen or conversation. This may not be the case if the adversary is able to record the target and obtain sensitive information upon review of the recording.

Skills required

  • Low: In most cases, an adversary can simply observe and retain the desired information.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Likelihood: High

Defence

How is it prevented and mitigated?

1
Be mindful of your surroundings when discussing or viewing sensitive information in public areas.
2
Pertaining to insider threats, ensure that sensitive information is not displayed to nor discussed around individuals without need-to-know access to said information.

Real world

MITRE example instances

Example instance 1Detail
An adversary can capture a target's banking credentials and transfer money to adversary-controlled accounts.
Example instance 2Detail
An adversary observes the target's mobile device lock screen pattern/passcode and then steals the device, which can now be unlocked.
Example instance 3Detail
An insider could obtain database credentials for an application and sell the credentials on the black market.
Example instance 4Detail
An insider overhears a conversation pertaining to classified information, which could then be posted on an anonymous online forum.
CAPEC-508: Shoulder Surfing — DayBreach Saldırı Sözlüğü · DayBreach