CAPEC-227: Sustained Client Engagement

Description

An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.

Likelihood of attack: Not rated by MITRE
Typical severity: Not rated by MITRE
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Abuse Existing Functionality

Prerequisites

This pattern of attack requires a temporal aspect to the servicing of a given request. Success can be achieved if the adversary can make requests that collectively take more time to complete than legitimate user requests within the same time frame.

Mitigations

Potential mitigations include requiring a unique login for each resource request, constraining local unprivileged access by disallowing simultaneous engagements of the resource, or limiting access to the resource to one access per IP address. In such scenarios, the adversary would have to increase engagements either by launching multiple sessions manually or programmatically to counter such defenses.

Related weaknesses (CWE)

CWE-400Uncontrolled Resource Consumption

ATT&CK techniques (CAPEC taxonomy mapping)

T1499Endpoint Denial of Service

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Related attack patterns

More specific patterns

CAPEC-469HTTP DoSStandard

Description

Mitigations

Potential mitigations include requiring a unique login for each resource request, constraining local unprivileged access by disallowing simultaneous engagements of the resource, or limiting access to the resource to one access per IP address. In such scenarios, the adversary would have to increase engagements either by launching multiple sessions manually or programmatically to counter such defenses.