CAPEC-2: Inducing Account Lockout
Description
An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
- Likelihood of attack
- High
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The system has a lockout mechanism.
- An attacker must be able to reproduce behavior that would result in an account being locked.
Skills required
- LowNo programming skills or computer knowledge is needed. An attacker can easily use this attack pattern following the Execution Flow above.
Consequences
- Availability
Resource Consumption
Denial of Service
Mitigations
- Implement intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.
- When implementing security features, consider how they can be misused and made to turn on themselves.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.