COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-536

Data Injected During Configuration

An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.

Soyutlama

Standard

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine configuration process

The adversary, through a previously compromised system, either remotely or physically, determines what the configuration process is. They look at configuration files, data files, and running processes on the system to identify areas where they could inject malicious data.

Determine when configuration occurs

The adversary needs to then determine when configuration or recalibration of a system occurs so they know when to inject malicious data.

Kullanılan teknikler

  • Look for a weekly update cycle or repeated update schedule.
  • Insert a malicious process into the target system that notifies the adversary when configuration is occurring.
2

Experiment

Determine malicious data to inject

By looking at the configuration process, the adversary needs to determine what malicious data they want to insert and where to insert it.

Kullanılan teknikler

  • Add false log data
  • Change configuration files
  • Change data files
3

Exploit

Inject malicious data

Right before, or during system configuration, the adversary injects the malicious data. This leads to the system behaving in a way that is beneficial to the adversary and is often followed by other attacks.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The attacker must have previously compromised the victim's systems or have physical access to the victim's systems.
  • Advanced knowledge of software and hardware capabilities of a manufacturer's product.

Gerekli beceri

  • High: Ability to generate and inject false data into operational data into a system with the intent of causing the victim to alter the configuration of the system.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Ensure that proper access control is implemented on all systems to prevent unauthorized access to system files and processes.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An adversary wishes to bypass a security system to access an additional network segment where critical data is kept. The adversary knows that some configurations of the security system will allow for remote bypass under certain conditions, such as switching a specific parameter to a different value. The adversary knows the bypass will work but also will be detected within the logging data of the security system. The adversary waits until an upgrade is performed to the security system by the victim's system administrators, and the adversary has access to an external logging system. The adversary injects false log entries that cause the administrators to think there are two different error states within the security system - one involving the specific parameter and the other involving the logging entries. The specific parameter is adjusted to a different value, and the logging level is reduced to a lower level that will not cause an adversary bypass to be detected. The adversary stops injecting false log data, and the administrators of the security system believe the issues were caused by the upgrade and are now resolved. The adversary is then able to bypass the security system.
CAPEC-536: Data Injected During Configuration — DayBreach Saldırı Sözlüğü · DayBreach