COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-637

Collect Data from Clipboard

The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.

Soyutlama

Detailed

Tipik ciddiyet

Low

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Find an application that allows copying sensititve data to clipboad

An adversary first needs to find an application that allows copying and pasting of sensitive information. This could be an application that prints out temporary passwords to the screen, private email addresses, or any other sensitive information or data
2

Experiment

Target users of the application

An adversary will target users of the application in order to obtain the information in their clipboard on a periodic basic

Kullanılan teknikler

  • Install malware on a user's system designed to log clipboard contents periodically
  • Get the user to click on a malicious link that will bring them to an application to log the contents of the clipboard
3

Exploit

Follow-up attack

Use any sensitive information found to carry out a follow-up attack

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary must have a means (i.e., a pre-installed tool or background process) by which to collect data from the clipboard and store it. That is, when the target copies data to the clipboard (e.g., to paste into another application), the adversary needs some means of capturing that data in a third location.

Gerekli beceri

  • High: To deploy a hidden process or malware on the system to automatically collect clipboard data.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
While copying and pasting of data with the clipboard is a legitimate and practical function, certain situations and context may require the disabling of this feature. Just as certain applications disable screenshot capability, applications that handle highly sensitive information should consider disabling copy and paste functionality.
2
Employ a robust identification and audit/blocking via using an allowlist of applications on your system. Malware may contain the functionality associated with this attack pattern.