COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-654

Credential Prompt Impersonation

An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.

Genişletilmiş açıklama

The adversary may monitor the task list maintained by the operating system and wait for a specific legitimate credential prompt to become active. Once the prompt is detected, the adversary launches a new credential prompt in the foreground that mimics the user interface of the legitimate credential prompt. At this point, the user thinks that they are interacting with the legitimate credential prompt, but instead they are interacting with the malicious credential prompt. A second approach involves the adversary impersonating an unexpected credential prompt, but one that may often be spawned by legitimate background processes. For example, an adversary may randomly impersonate a system credential prompt, implying that a background process or commonly used application (e.g., email reader) requires authentication for some purpose. The user, believing they are interacting with a legitimate credential prompt, enters their credentials which the adversary then leverages for nefarious purposes. The ultimate goal of this attack is to obtain sensitive information (e.g., credentials) from the user.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine suitable tasks to exploit

Determine what tasks exist on the target system that may result in a user providing their credentials.

Kullanılan teknikler

  • Determine what tasks prompt a user for their credentials.
2

Exploit

Impersonate Task

Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials.

Kullanılan teknikler

  • Prompt a user for their credentials, while making the user believe the credential request is legitimate.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary must already have access to the target system via some means.
  • A legitimate task must exist that an adversary can impersonate to glean credentials.

Gerekli beceri

  • Low: Once an adversary has gained access to the target system, impersonating a credential prompt is not difficult.

Gerekli kaynak

  • Malware or some other means to initially comprise the target system.
  • Additional malware to impersonate a legitimate credential prompt.

Tespit

Saldırının göstergeleri nelerdir?

Credential prompts that appear illegitimate or unexpected.

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Access Control, Authentication

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An adversary monitors the system task list for Microsoft Outlook in an attempt to determine when the application may prompt the user to enter their credentials to view encrypted email. Once the task is executed, the adversary impersonates the credential prompt to obtain the user's Microsoft Outlook encryption credentials. These credentials can then be leveraged by the adversary to read a user's encrypted email.
Örnek olay 2Detay
An adversary randomly prompts a user to enter their system credentials, tricking the user into believing that a background process requires the credentials to function. The adversary can then use these gleaned credentials to execute additional attacks or obtain data.