COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-480

Escaping Virtualization

An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.

Soyutlama

Standard

Tipik ciddiyet

Very High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Probing

The adversary probes the target application, service, or device to find a possible weakness that would allow escaping the virtualized environment.

Kullanılan teknikler

  • Probing applications, services, or devices for virtualization weaknesses.
2

Experiment

Verify the exploitable security weaknesses

Using the found weakness, the adversary attempts to escape the virtualized environment.

Kullanılan teknikler

  • Using an application weakness to escape a virtualized environment
3

Exploit

Execute more complex attacks

Once outside of the virtualized environment, the adversary attempts to perform other more complex attacks such as accessing system resources or executing unauthorized code within the host environment.

Kullanılan teknikler

  • Executing complex attacks when given higher permissions by escaping a virtualized environment

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Target application or infrastructure exposes an exploitable vulnerability surface.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Bypass Protection Mechanism

Etkilenen alanlar: Access Control, Authorization

Execute Unauthorized Commands

Etkilenen alanlar: Authorization

Gain Privileges

Etkilenen alanlar: Accountability, Authentication, Authorization, Non-Repudiation

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Ensure virtualization software is current and up-to-date.
2
Abide by the least privilege principle to avoid assigning users more privileges than necessary.
CAPEC-480: Escaping Virtualization — DayBreach Saldırı Sözlüğü · DayBreach