CAPEC-701: Browser in the Middle (BiTM)
Description
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local authentication APIs, a hardware token, or a Trusted Platform Module (TPM) to authenticate.
Skills required
- Medium
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- ConfidentialityAuthorization
Read Data
- Integrity
Modify Data
Mitigations
- Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel