MetaCAPEC-216
CAPEC-216: Communication Channel Manipulation
Description
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The target application must leverage an open communications channel.
- The channel on which the target communicates must be vulnerable to interception (e.g., adversary in the middle attack - CAPEC-94).
Consequences
- Integrity
Read Data; Modify Data; Other
The adversary's injection of additional content into a communication channel negatively impacts the integrity of that channel.
- Confidentiality
Read Data
A successful Communication Channel Manipulation attack can result in sensitive information exposure to the adversary, thereby compromising the communication channel's confidentiality.
Mitigations
- Encrypt all sensitive communications using properly-configured cryptography.
- Design the communication system such that it associates proper authentication/authorization with each channel/message.