COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-546

Incomplete Data Deletion in a Multi-Tenant Environment

An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.

Abstraction

Detailed

Typical severity

Medium

Likelihood of attack

Low

Understand the attack

What is this attack pattern?

An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.

Requirements

What does the attack require?

Prerequisites

  • The cloud provider must not assuredly delete part or all of the sensitive data for which they are responsible.The adversary must have the ability to interact with the system.

Skills required

  • Low: The adversary requires the ability to traverse directory structure.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

1
Cloud providers should completely delete data to render it irrecoverable and inaccessible from any layer and component of infrastructure resources.
2
Deletion of data should be completed promptly when requested.