CAPEC-474: Signature Spoofing by Key Theft
Description
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- An authoritative or reputable signer is storing their private signature key with insufficient protection.
Skills required
- LowKnowledge of common location methods and access methods to sensitive data
- HighAbility to compromise systems containing sensitive data
Mitigations
- Restrict access to private keys from non-supervisory accounts
- Restrict access to administrative personnel and processes only
- Ensure all remote methods are secured
- Ensure all services are patched and up to date
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared
- D3-DUCDecoy User Credential1 shared
- D3-MFAMulti-factor Authentication1 shared
- D3-RICReissue Credential1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-AMAccess Modeling1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.