Home > CAPEC List > CAPEC-173: Action Spoofing (Version 2.11)  

CAPEC-173: Action Spoofing

Action Spoofing
Definition in a New Window Definition in a New Window
Attack Pattern ID: 173
Abstraction: Meta
Status: Stable
Completeness: Complete
Presentation Filter:
+ Summary

An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action. For example, a user might be led to believe that clicking a button will submit a query, but in fact it downloads software. Adversaries may perform this attack through social means, such as by simply convincing a victim to perform the action or relying on a user's natural inclination to do so, or through technical means, such as a clickjacking attack where a user sees one interface but is actually interacting with a second, invisible, interface.

+ Attack Prerequisites
  • The adversary must convince the victim into performing the decoy action.

  • The adversary must have the means to control a user's interface to present them with a decoy action as well as the actual malicious action. Simple versions of this attack can be performed using web pages requiring only that the adversary be able to host (or control) content that the user visits.

+ Typical Severity

Very High

+ Typical Likelihood of Exploit

Likelihood: High

+ Solutions and Mitigations

Avoid interacting with suspicious sites or clicking suspicious links.

An organization should provide regular, robust cybersecurity training to its employees.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
"Varies by context"
Action spoofing can result in a wide variety of consequences and negatively affect all three elements of the security triad.
+ Content History
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
CAPEC Content TeamThe MITRE Corporation2017-05-01Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_ExploitInternal

More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2017