COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-94

Adversary in the Middle (AiTM)

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

Soyutlama

Meta

Tipik ciddiyet

Very High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

Genişletilmiş açıklama

Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first flows through the adversary, who has the opportunity to observe or alter it, before being passed on to the intended recipient as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for these attacks yields an implicit lack of trust in communication or identify between two components. These attacks differ from Sniffing Attacks ( CAPEC-157 ) since these attacks often modify the communications prior to delivering it to the intended recipient.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine Communication Mechanism

The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit.

Kullanılan teknikler

  • Perform a sniffing attack and observe communication to determine a communication protocol.
  • Look for application documentation that might describe a communication mechanism used by a target.
2

Experiment

Position In Between Targets

The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.

Kullanılan teknikler

  • Install spyware on a client that will intercept outgoing packets and route them to their destination as well as route incoming packets back to the client.
  • Exploit a weakness in an encrypted communication mechanism to gain access to traffic. Look for outdated mechanisms such as SSL.
3

Exploit

Use Intercepted Data Maliciously

The adversary observes, filters, or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.

Kullanılan teknikler

  • Prevent some messages from reaching their destination, causing a denial of service.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • There are two components communicating with each other.
  • An attacker is able to identify the nature and mechanism of communication between the two target components.
  • An attacker can eavesdrop on the communication between the target components.
  • Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
  • The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

Gerekli beceri

  • Medium: This attack can get sophisticated since the attack may use cryptography.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Modify Data

Etkilenen alanlar: Integrity

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Ensure Public Keys are signed by a Certificate Authority
2
Encrypt communications using cryptography (e.g., SSL/TLS)
3
Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
4
Exchange public keys using a secure channel

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
In 2017, security researcher Jerry Decime discovered that Equifax mobile applications were not leveraging HTTPS in all areas. Although authentication was properly utilizing HTTPS, in addition to validating the root of trust of the server certificate, other areas of the application were using HTTP to communicate. Adversaries could then conduct MITM attacks on rogue WiFi or cellular networks and hijack the UX. This further allowed the adversaries to prompt users for sensitive data, which could then be obtained in the plaintext response. [ REF-636 ]
CAPEC-94: Adversary in the Middle (AiTM) — DayBreach Saldırı Sözlüğü · DayBreach