CAPEC-633: Token Impersonation
Description
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity.
Consequences
- Integrity
Alter Execution Logic
By faking the source of data or services, an adversary can cause a target to make incorrect decisions about how to proceed.
- Integrity
Gain Privileges
By impersonating identities that have an increased level of access, an adversary gain privilege that they many not have otherwise had.
- Integrity
Hide Activities
Faking the source of data or services can be used to create a false trail in logs as the target will associated any actions with the impersonated identity instead of the adversary.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-STSession Termination1 shared
- D3-NTPMNetwork Traffic Policy Mapping1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared