CAPEC-192: Protocol Analysis
Description
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
- Likelihood of attack
- Low
- Typical severity
- Low
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- Access to a binary executable.
- The ability to observe and interact with a communication channel between communicating processes.
Skills required
- HighKnowlegde of the Open Systems Interconnection model (OSI model), and famililarity with Wireshark or some other packet analyzer.
Consequences
- Confidentiality
Read Data
Successful deciphering of protocol information compromises the confidentiality of future sensitive communications.
- Integrity
Modify Data
Modifying communications after successful deciphering of protocol information compromises integrity.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.