Attackers can capture appplication code bound for the client and can use
it, as-is or through reverse-engineering, to glean sensitive information or
exploit the trust relationship between the client and server.
Such code may belong to a dynamic update to the client, a patch being
applied to a client component or any such interaction where the client is
authorized to communicate with the server.
Attack Execution Flow
The attacker sets up a sniffer (and an
interceptor, as the motive of the attack may be) in
the path between the server and the client
The captured code is then used as part of a larger
attack, such as reverse-engineering the code or
denying its delivery to the client or altering its
contents on way to the client
Attack Prerequisites
The attacker must have the ability to place himself in the communication
path between the client and server.
The targeted application must receive some application code from the
server; for example, dynamic updates, patches, applets or scripts.
The attacker must be able to employ a sniffer on the network without being
detected.
Typical Likelihood of Exploit
Likelihood: Low
Examples-Instances
Description
Attacker receives notification that the computer/OS/application has an
available update, loads a network sniffing tool, and extracts update
data from subsequent communication.
The attacker then proceeds to reverse engineer the captured
stream.
Description
Plain code, such as applets or Javascript, is also part of the
executing application. If such code is transmitted unprotected, the
attacker can capture the code and possibly reverse engineer it to gain
sensitive information, such as encryption keys, validation algorithms
and such.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Medium
The attacker needs to setup a sniffer for a sufficient period of time
so as to capture meaningful quantities of code. The presence of the
sniffer should not be detected on the network. Also if the attacker
plans to employ a man-in-the-middle attack, the client or server must
not realize this. Finally, the attacker needs to regenerate source code
from binary code if the need be.
Resources Required
The Attacker needs the ability to capture communications between the client
being updated and the server providing the update.
In the case that encryption obscures client/server communication the attacker
will either need to lift key material from the client.
Vision and Technical Leadership provided by Cigital, Inc.
This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.
Description
