Home > CAPEC List > CAPEC-260: DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution (Version 2.10)  

CAPEC-260: DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution

 
DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution
Definition in a New Window Definition in a New Window
Attack Pattern ID: 260
Abstraction: Detailed
Status: Deprecated
Completeness: Complete
Presentation Filter:
+ Summary

Attackers can capture new application installation code bound for an authorized client during initial distribution and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server.

+ Attack Execution Flow
Explore
  1. Set up a sniffer:

    The attacker sets up a sniffer in the path between the server and the client and watches the traffic.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    The attacker sets up a sniffer in the path between the server and the client.

    env-ClientServer

    Outcomes

    IDTypeOutcome Description
    1Success
    The attacker successfully sets up a sniffer in the path between the server and client.
    2Failure
    The attacker could not set up a sniffer in the path between the server and client.

    Security Controls

    IDTypeSecurity Control Description
    1Detective
    Check the network interface (e.g., ifconfig/ipconfig) to see whether the network adapter is running in promiscuous mode.
    2Preventative
    Encrypt all communications between the server and client.
Exploit
  1. Capturing Application Code Bound During Patching:

    Attacker knows that the computer/OS/application can install additional components or full applications as requested by the user, loads the sniffer set up during Explore phase, and extracts the downloaded code from subsequent communication. The attacker then proceeds to reverse engineer the captured code and the communication protocols used.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    Attacker loads the sniffer to capture the application code bound during an initial installation.

    env-Web
    2

    The attacker proceeds to reverse engineer the captured code.

    env-All

    Indicators

    IDTypeIndicator DescriptionEnvironments
    1Positive

    The attacker can capture the application code bound for the target.

    env-Web
    2Inconclusive

    The communication between the server and client is encrypted. The attacker may still possible to lift key material from the client.

    env-Web

    Outcomes

    IDTypeOutcome Description
    1Success
    The attacker captures the application code bound for the target and reverse engineers the captured code.

    Security Controls

    IDTypeSecurity Control Description
    1Detective
    Check the network interface (e.g., ifconfig) to detect the sniffer.
    2Preventative
    Encrypt all communications between the server and client.
+ Attack Prerequisites
  • The attacker must be able to employ a sniffer in the path between the server and client without being detected. The targeted operating system or application must be configured to allow for end users to request new components and applications from the server.

+ Typical Severity

Medium

+ Typical Likelihood of Exploit

Likelihood: Low

+ Methods of Attack
  • API Abuse
  • Protocol Manipulation
+ Examples-Instances

Description

In the following example, the attacker sets up a sniffer between a victim client and the server. The attacker sniffs the traffic and captures the installation of a new application. The attacker reverse engineers the traffic to gain sensitive information, such as encryption keys, validation algorithms, etc. Additionally the attacker now knows specific version information regarding an installed application on the victim client, and may use this information in subsequent social engineering or direct application attack.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

The attacker needs to setup a sniffer for a sufficient period of time so as to capture meaningful quantities of code. The presence of the sniffer should not be detected on the network.

Skill or Knowledge Level: High

The attacker needs to be able to reverse engineer any binary code captured during an initial installation.

+ Resources Required

The Attacker needs the ability to capture communications between the client and server during an initial installation. In the case that encryption obscures client/server communication the attacker needs to lift key material from the client.

+ Solutions and Mitigations

Design: Encrypt all communication between the client and server.

Implementation: Use SSL, SSH, SCP.

Operation: Use "ifconfig/ipconfig" or other tools to detect the sniffer installed in the network.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Confidentiality
"Varies by context"
Information Leakage
Integrity
Modify files or directories
Confidentiality
Read files or directories
Accountability
Authentication
Authorization
Non-Repudiation
Gain privileges / assume identity
+ Purposes
  • Exploitation
  • Reconnaissance
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: MediumAvailability Impact: Low
+ Technical Context
Architectural Paradigms
Client-Server
Frameworks
All
Platforms
All
Languages
All
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2017-01-09Updated Related_Attack_PatternsInternal
Previous Entry Names
DatePrevious Entry Name
2017-01-09Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017