COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-639

Probe System Files

An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

Abstraction

Detailed

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

Requirements

What does the attack require?

Prerequisites

  • An adversary has access to the file system of a system.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

1
Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.

Real world

MITRE example instances

Example instance 1Detail
Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Example instance 2Detail
Adversaries may search network shares on computers they have compromised to find files of interest.
CAPEC-639: Probe System Files — DayBreach Saldırı Sözlüğü · DayBreach