CAPEC-94: Adversary in the Middle (AiTM)

MITRE CAPEC attack pattern

Description

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-287, CWE-290, CWE-294, CWE-300, CWE-593

ATT&CK techniques: T1557

Prerequisites

• There are two components communicating with each other.
• An attacker is able to identify the nature and mechanism of communication between the two target components.
• An attacker can eavesdrop on the communication between the target components.
• Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
• The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

Skills required

• Medium: This attack can get sophisticated since the attack may use cryptography.

Consequences

• Integrity: Modify Data
• Confidentiality, Access Control, Authorization: Gain Privileges
• Confidentiality: Read Data

Mitigations

• Ensure Public Keys are signed by a Certificate Authority
• Encrypt communications using cryptography (e.g., SSL/TLS)
• Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
• Exchange public keys using a secure channel

Source

• MITRE CAPEC CAPEC-94