|
|
| Home > CAPEC List > Individual CAPEC Dictionary Definition (Release 1.1) | View the CAPEC List |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Individual CAPEC Dictionary Definition (Release 1.1)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Man in the Middle Attack | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Attack Pattern ID | Pattern Abstraction: Standard 94 | ||||||||||||||||||||||||||||
| Typical Severity | Very High | ||||||||||||||||||||||||||||
| Description | Summary This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakeage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components. Attack Execution Flow
| ||||||||||||||||||||||||||||
| Attack Prerequisites | There are two components communicating with each other. An attacker is able to identify the nature and mechanism of communication between the two target components. An attacker can eavesdrop on the communication between the target components. Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition. The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption. | ||||||||||||||||||||||||||||
| Typical Likelihood of Exploit | Very High | ||||||||||||||||||||||||||||
| Methods of Attack |
| ||||||||||||||||||||||||||||
| Examples-Instances | Description Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications. Related Vulnerability CVE-2006-0231 | ||||||||||||||||||||||||||||
| Attacker Skill or Knowledge Required | Medium/High: This attack can get sophisticated since the attack may use cryptography. | ||||||||||||||||||||||||||||
| Probing Techniques | The attacker can try to get the public-keys of the victims. There are free software tool to perform man in the middle attack (packet anlaysis, etc.) | ||||||||||||||||||||||||||||
| Solutions and Mitigations | Get your Public Key signed by a Certificate Authority Encrypt your communication using cryptography (SSL,...) Use Strong mutual authentication to always fully authenticate both ends of any communications channel. Exchange public keys using a secure channel | ||||||||||||||||||||||||||||
| Attack Motivation- |
| ||||||||||||||||||||||||||||
| Context Description | A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure. | ||||||||||||||||||||||||||||
| Injection Vector | The captured or modified data in transit | ||||||||||||||||||||||||||||
| Payload | The new value of the data or the replay of the same data (e.g. credential) | ||||||||||||||||||||||||||||
| Activation Zone | The messages exchanged between the two target hosts. | ||||||||||||||||||||||||||||
| Payload Activation Impact | Privilege escalation. modification of resource, information leakage, etc. | ||||||||||||||||||||||||||||
| Related Weaknesses |
| ||||||||||||||||||||||||||||
| Related Security Principles |
| ||||||||||||||||||||||||||||
| Purpose | Exploitation | ||||||||||||||||||||||||||||
| CIA Impact |
| ||||||||||||||||||||||||||||
| Technical Context |
| ||||||||||||||||||||||||||||
| References | CWE – Man-in-the-middle (MITM) M. Bishop. Computer Security: Art and Science. Addison-Wesley, 2003. | ||||||||||||||||||||||||||||
| Source |
| ||||||||||||||||||||||||||||
|
|
|