StandardCAPEC-473
CAPEC-473: Signature Spoof
Description
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions.
- The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature.
Skills required
- HighTechnical understanding of how signature verification algorithms work with data and applications
Consequences
- Access ControlAuthentication
Gain Privileges
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CQContent Quarantine2 shared
- D3-SJAScheduled Job Analysis1 shared
- D3-SFASystem File Analysis1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-CIConfiguration Inventory1 shared
- D3-RCRestore Configuration1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
Related attack patterns
Parent
More specific patterns
- CAPEC-459Creating a Rogue Certification Authority CertificateDetailed
- CAPEC-474Signature Spoofing by Key TheftDetailed
- CAPEC-475Signature Spoofing by Improper ValidationDetailed
- CAPEC-476Signature Spoofing by MisrepresentationDetailed
- CAPEC-477Signature Spoofing by Mixing Signed and Unsigned ContentDetailed
- CAPEC-479Malicious Root CertificateDetailed
- CAPEC-485Signature Spoofing by Key RecreationDetailed