MetaSeverity: HighCAPEC-112

CAPEC-112: Brute Force

Description

In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.

Likelihood of attack: Not rated by MITRE
Typical severity: High
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Employ Probabilistic Techniques

Prerequisites

The attacker must be able to determine when they have successfully guessed the secret. As such, one-time pads are immune to this type of attack since there is no way to determine when a guess is correct.

Skills required

LowThe attack simply requires basic scripting ability to automate the exploration of the search space. More sophisticated attackers may be able to use more advanced methods to reduce the search space and increase the speed with which the secret is located.

Consequences

Confidentiality
Read Data
ConfidentialityAccess ControlAuthorization
Gain Privileges

Mitigations

Select a provably large secret space for selection of the secret. Provably large means that the procedure by which the secret is selected does not have artifacts that significantly reduce the size of the total secret space.
Use a secret space that is well known and with no known patterns that may reduce functional size.
Do not provide the means for an attacker to determine success independently. This forces the attacker to check their guesses against an external authority, which can slow the attack and warn the defender. This mitigation may not be possible if testing material must appear externally, such as with a transmitted cryptotext.

Related weaknesses (CWE)

ATT&CK techniques (CAPEC taxonomy mapping)

T1110Brute Force

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

Related attack patterns

More specific patterns

Description

Mitigations

Select a provably large secret space for selection of the secret. Provably large means that the procedure by which the secret is selected does not have artifacts that significantly reduce the size of the total secret space.

Use a secret space that is well known and with no known patterns that may reduce functional size.

Do not provide the means for an attacker to determine success independently. This forces the attacker to check their guesses against an external authority, which can slow the attack and warn the defender. This mitigation may not be possible if testing material must appear externally, such as with a transmitted cryptotext.