Home > CAPEC List > CAPEC-151: Identity Spoofing (Version 2.10)  

CAPEC-151: Identity Spoofing

 
Identity Spoofing
Definition in a New Window Definition in a New Window
Attack Pattern ID: 151
Abstraction: Meta
Status: Stable
Completeness: Complete
Presentation Filter:
+ Summary

Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an adversary may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the apparent identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the apparent identity of the message but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.

+ Attack Prerequisites
  • The identity associated with the message or resource must be removable or modifiable in an undetectable way.

+ Typical Severity

Medium

+ Typical Likelihood of Exploit

Likelihood: Medium

+ Resources Required

No special resource are required for most variants of this attack.

+ Solutions and Mitigations

Employ robust authentication processes (e.g., multi-factor authentication).

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Confidentiality
Integrity
Authentication
Access_Control
Gain privileges / assume identity
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2017-05-01Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_ExploitInternal
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017