CAPEC-194: Fake the Source of Data
Description
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified From field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- This attack is only applicable when a vulnerable entity associates data or services with an identity. Without such an association, there would be no reason to fake the source.
Consequences
- Integrity
Alter Execution Logic
By faking the source of data or services, an adversary can cause a target to make incorrect decisions about how to proceed.
- Integrity
Gain Privileges
By impersonating identities that have an increased level of access, an adversary gain privilege that they many not have otherwise had.
- Integrity
Hide Activities
Faking the source of data or services can be used to create a false trail in logs as the target will associate any actions with the impersonated identity instead of the adversary.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.