DetailedSeverity: Very HighCAPEC-37

CAPEC-37: Retrieve Embedded Sensitive Data

Description

An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

Likelihood of attack: High
Typical severity: Very High
Abstraction: DetailedA low-level, detailed pattern, often for a particular technology.

Mechanism of attack: Collect and Analyze Information

Prerequisites

In order to feasibly execute this type of attack, some valuable data must be present in client software.
Additionally, this information must be unprotected, or protected in a flawed fashion, or through a mechanism that fails to resist reverse engineering, statistical, or other attack.

Skills required

MediumThe attacker must possess knowledge of client code structure as well as ability to reverse-engineer or decompile it or probe it in other ways. This knowledge is specific to the technology and language used for the client distribution

Consequences

Confidentiality
Read Data
Integrity
Modify Data
ConfidentialityAccess ControlAuthorization
Gain Privileges

Mitigations

CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.

Related weaknesses (CWE)

ATT&CK techniques (CAPEC taxonomy mapping)

Across MITRE's defensive frameworks

Linked through the 2 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

CAR-2020-09-004Credentials in Files & Registry1 shared

Related attack patterns

Parent

CAPEC-167White Box Reverse EngineeringStandard