MetaSeverity: Very HighCAPEC-94

CAPEC-94: Adversary in the Middle (AiTM)

Description

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

Likelihood of attack: High
Typical severity: Very High
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Subvert Access Control

Prerequisites

There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
An attacker can eavesdrop on the communication between the target components.
Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

Skills required

MediumThis attack can get sophisticated since the attack may use cryptography.

Consequences

Integrity
Modify Data
ConfidentialityAccess ControlAuthorization
Gain Privileges
Confidentiality
Read Data

Mitigations

Ensure Public Keys are signed by a Certificate Authority
Encrypt communications using cryptography (e.g., SSL/TLS)
Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
Exchange public keys using a secure channel

Related weaknesses (CWE)

ATT&CK techniques (CAPEC taxonomy mapping)

T1557Adversary-in-the-Middle

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Related attack patterns

More specific patterns