COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-690

Metadata Spoofing

An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible.

Abstraction

Meta

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible.

Extended description

One approach to this attack entails the adversary altering a maliciously modified resource's metadata in order to hide their malicious activity. Another approach involves altering the metadata of an adversary-created resource to make the source appear more credible. Adversaries may spoof a variety of metadata across a number of resources, such as the following: Authors of Version Control System (VCS) repository commits Open source package statistics File attributes, such as when a file was last update The ultimate goal of a Metadata Spoofing attack is to trick victims into believing the malicious resource being provided originates from a reputable source. However, the victim instead leverages the malicious resource, which could result in a number of negative technical impacts.

Requirements

What does the attack require?

Prerequisites

  • Identification of a resource whose metadata is to be spoofed

Skills required

  • Medium: Ability to spoof a variety of metadata to convince victims the source is trusted

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Modify Data

Affected scopes: Integrity

Hide Activities

Affected scopes: Accountability

Execute Unauthorized Commands

Affected scopes: Access Control, Authorization

Defence

How is it prevented and mitigated?

1
Validate metadata of resources such as authors, timestamps, and statistics.
2
Confirm the pedigree of open source packages and ensure the code being downloaded does not originate from another source.
3
Even if the metadata is properly checked and a user believes it to be legitimate, there may still be a chance that they've been duped. Therefore, leverage automated testing techniques to determine where malicious areas of the code may exist.