CAPEC-114: Authentication Abuse
Description
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Subvert Access Control
Prerequisites
- An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc. which is flawed in some way.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-AMAccess Modeling1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.