Home > CAPEC List > CAPEC-65: Sniff Application Code (Version 2.9)  

CAPEC-65: Sniff Application Code

 
Sniff Application Code
Definition in a New Window Definition in a New Window
Attack Pattern ID: 65
Abstraction: Detailed
Status: Draft
Completeness: Complete
Presentation Filter:
+ Summary

An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.

+ Attack Execution Flow
Explore
  1. The attacker sets up a sniffer in the path between the server and the client and watches the traffic.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    The attacker sets up a sniffer in the path between the server and the client.

    env-ClientServer

    Outcomes

    IDTypeOutcome Description
    1Success
    The attacker successfully sets up a sniffer in the path between the server and client.
    2Failure
    The attacker could not set up a sniffer in the path between the server and client.

    Security Controls

    IDTypeSecurity Control Description
    1Detective
    Check the network interface (e.g., ifconfig/ipconfig) to see whether the network adapter is running in promiscuous mode.
    2Preventative
    Encrypt all communications between the server and client.
Exploit
  1. Attacker knows that the computer/OS/application can request new applications to install, or it periodically checks for an available update. The attacker loads the sniffer set up during Explore phase, and extracts the application code from subsequent communication. The attacker then proceeds to reverse engineer the captured code.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    Attacker loads the sniffer to capture the application code bound during a dynamic update.

    env-Web
    2

    The attacker proceeds to reverse engineer the captured code.

    env-All

    Indicators

    IDTypeIndicator DescriptionEnvironments
    1Positive

    The attacker can capture the application code bound for the target.

    env-Web
    2Inconclusive

    The communication between the server and client is encrypted. The attacker may still possible to lift key material from the client.

    env-Web

    Outcomes

    IDTypeOutcome Description
    1Success
    The attacker captures the application code bound for the target and reverse engineers the captured code.

    Security Controls

    IDTypeSecurity Control Description
    1Detective
    Check the network interface (e.g., ifconfig) to detect the sniffer.
    2Preventative
    Encrypt all communications between the server and client.
+ Attack Prerequisites
  • The attacker must have the ability to place himself in the communication path between the client and server.

  • The targeted application must receive some application code from the server; for example, dynamic updates, patches, applets or scripts.

  • The attacker must be able to employ a sniffer on the network without being detected.

+ Typical Severity

High

+ Typical Likelihood of Exploit

Likelihood: Low

+ Examples-Instances

Description

Attacker receives notification that the computer/OS/application has an available update, loads a network sniffing tool, and extracts update data from subsequent communication. The attacker then proceeds to reverse engineer the captured stream to gain sensitive information, such as encryption keys, validation algorithms, applications patches, etc..

Description

Plain code, such as applets or JavaScript, is also part of the executing application. If such code is transmitted unprotected, the attacker can capture the code and possibly reverse engineer it to gain sensitive information, such as encryption keys, validation algorithms and such.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

The attacker needs to setup a sniffer for a sufficient period of time so as to capture meaningful quantities of code. The presence of the sniffer should not be detected on the network. Also if the attacker plans to employ a man-in-the-middle attack, the client or server must not realize this. Finally, the attacker needs to regenerate source code from binary code if the need be.

+ Resources Required

The Attacker needs the ability to capture communications between the client being updated and the server providing the update.

In the case that encryption obscures client/server communication the attacker will either need to lift key material from the client.

+ Solutions and Mitigations

Design: Encrypt all communication between the client and server.

Implementation: Use SSL, SSH, SCP.

Operation: Use "ifconfig/ipconfig" or other tools to detect the sniffer installed in the network.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Confidentiality
Read application data
Confidentiality
Access_Control
Authorization
Gain privileges / assume identity
+ Relevant Security Requirements

Do not store secrets in client code

All potentially sensitive data, including code, transmitted to the client must be encrypted

+ Purposes
  • Reconnaissance
  • Exploitation
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: MediumAvailability Impact: Low
+ Technical Context
Architectural Paradigms
Client-Server
Frameworks
All
Platforms
All
Languages
All
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2015-11-09Updated Description Summary, Related_Attack_PatternsInternal
CAPEC Content TeamThe MITRE Corporation2015-12-07Updated Description SummaryInternal
CAPEC Content TeamThe MITRE Corporation2017-01-09Updated Related_Attack_PatternsInternal
Previous Entry Names
DatePrevious Entry Name
2015-12-07Passively Sniff and Capture Application Code Bound for Authorized Client

More information is available — Please select a different filter.
Page Last Updated or Reviewed: December 07, 2015