Common Attack Pattern Enumeration and Classification

Common Attack Pattern Enumeration and Classification

Summary

Attack Execution Flow

1. Identify inputs for OS commands: The attacker determines user controllable input that gets passed as part of a command to the underlying operating system.

   Attack Step Techniques
   Description	Environments
   Port mapping. Identify ports that the system is listening on, and attempt to identify inputs and protocol types on those ports.	env-Local env-CommProtocol env-Peer2Peer env-ClientServer
   TCP/IP Fingerprinting. The attacker uses various software to make connections or partial connections and observe idiosyncratic responses from the operating system. Using those responses, he attempts to guess the actual operating system.	env-Embedded env-ClientServer env-Peer2Peer env-CommProtocol env-Web
   Induce errors to find informative error messages	env-All

   Indicator of Susceptibility
   ID	Type	Description	Environments
   c88s1i1	Positive	The target software accepts connections via the network.	env-Web env-CommProtocol env-Peer2Peer env-Embedded env-ClientServer

   Outcomes
   ID	Type	Description
   c88s1o1	Success	Operating environment (operating system, language, and/or middleware) is correctly identified.
   c88s1o2	Inconclusive	Multiple candidate operating environments are suggested.

   Security Controls
   ID	Type	Description
   c88s1s1	Preventative	Provide misleading information on TCIP/IP fingerprints (some operating systems can be configured to send signatures that match other operating systems).
   c88s1s2	Preventative	Provide misleading information at the server level (e.g., Apache, IIS, WebLogic, etc.) to announce a different server software.
   c88s1s3	Detective	Some fingerprinting techniques can be detected by operating systems or by network IDS systems because they leave the network connection half-open, or they do not belong to a valid, open connection.

2. Survey the Application: The attacker surveys the target application, possibly as a valid and authenticated user

   Attack Step Techniques
   Description	Environments
   Spidering web sites for all available links	env-Web
   Inventory all application inputs	env-All

   Indicator of Susceptibility
   ID	Type	Description	Environments
   c88s2i1	Positive	Attacker develops a list of valid inputs	env-All

   Outcome
   ID	Type	Description
   c88s2o1	Success	The attacker develops a list of likely command delimiters.

   Security Controls
   ID	Type	Description
   c88s2s1	Detective	Monitor velocity of page fetching in web logs. Humans who view a page and select a link from it will click far slower and far less regularly than tools. Tools make requests very quickly and the requests are typically spaced apart regularly (e.g. 0.8 seconds between them).
   c88s2s2	Detective	Create links on some pages that are visually hidden from web browsers. Using IFRAMES, images, or other HTML techniques, the links can be hidden from web browsing humans, but visible to spiders and programs. A request for the page, then, becomes a good predictor of an automated tool probing the application.
   c88s2s3	Preventative	Actively monitor the application and either deny or redirect requests from origins that appear to be automated.
   c88s2s4	Detective	Monitor velocity of feature activations (non-web software). Humans who activate features (click buttons, request actions, invoke APIs, etc.) will do so far slower and far less regularly than tools. Tools make requests very quickly and the requests are typically spaced apart regularly (e.g. 0.8 seconds between them).

1. Vary inputs, looking for malicious results.: Depending on whether the application being exploited is a remote or local one the attacker crafts the appropriate malicious input, containing OS commands, to be passed to the application

   Attack Step Techniques
   Description	Environments
   Inject command delimiters using network packet injection tools (netcat, nemesis, etc.)	env-CommProtocol env-Web env-Peer2Peer env-ClientServer
   Inject command delimiters using web test frameworks (proxies, TamperData, custom programs, etc.)	env-Web

   Indicator of Susceptibility
   ID	Type	Description	Environments
   c88s3i1	Positive	Inventorying in prior step is successful.	env-All

   Outcome
   ID	Type	Description
   c88s3o1	Success	One or more injections that are appropriate to the platform provokes an unexpected response from the software, which can be varied by the attacker based on the input.

1. Execute malicious commands: The attacker may steal information, install a back door access mechanism, elevate privileges or compromise the system in some other way.

   Attack Step Techniques
   Description	Environments
   The attacker executes a command that stores sensitive information into a location where he can retrieve it later (perhaps using a different command injection).	env-All
   The attacker executes a command that stores sensitive information into a location where he can retrieve it later (perhaps using a different command injection).	env-All
   The attacker executes a command that stores sensitive information into a location where he can retrieve it later (perhaps using a different command injection).	env-All

   Outcome
   ID	Type	Description
   c88s4o1	Success	The software performs an action the attacker desires. This might be displaying information, storing a program, executing a command, or some other malicious activity.

   Security Controls
   ID	Type	Description
   c88s4s1	Preventative	Make commonly exploited administrative tools log their execution.
   c88s4s2	Preventative	Make commonly exploited administrative tools non-executable, except when the system is in specific maintenance periods. (i.e., require administrators to specifically enable certain administrative commands prior to performing system maintenance.)

Description

Related Vulnerability