An adversary takes advantage of incorrectly configured SSL/TLS communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.
Description
Attack Execution Flow
3
1
Step 1
Explore[Determine SSL/TLS Configuration] Determine the SSL/TLS configuration of either the server or client being targeted, preferably both. This is not a hard requirement, as the adversary can simply assume commonly exploitable configuration settings and indiscriminately attempt them.
If the target is a webpage, some of the SSL/TLS configuration can be viewed through the browser's security information, such as the key sizes and cipher being used.
AI Translation
[Determina Configurazione SSL/TLS] Determina la configurazione SSL/TLS del server o del client bersaglio, preferibilmente entrambi. Questo non è un requisito stringente, poiché l'avversario può semplicemente presumere impostazioni di configurazione comunemente sfruttabili e tentare indiscriminatamente.
Se il bersaglio è una pagina web, alcune delle configurazioni SSL/TLS possono essere visualizzate attraverso le informazioni di sicurezza del browser, come le dimensioni delle chiavi e i cifrari utilizzati.
Attack Techniques
-
If the target is a webpage, some of the SSL/TLS configuration can be viewed through the browser's security information, such as the key sizes and cipher being used.
2
Step 2
Experiment[Intercept Communication] Provide controlled access to the server by the client, by either providing a link for the client to click on, or by positioning one's self at a place on the network to intercept and control the flow of data between client and server, e.g. AiTM (adversary in the middle - CAPEC-94).
Create a malicious webpage that looks identical to the target webpage, but routes client traffic to the server such that the adversary can observe the traffic and perform an adverary in the middle attack.
If the adversary has access to the network that either the client or server is on, the can attempt to use a packet sniffer to perform an adversary in the middle attack.
Install a packet sniffer through malware directly to a client device that can intercept SSL/TLS traffic and perform an adversary in the middle attack.
AI Translation
[Intercept Communication] Fornire access controllato al server da parte del client, sia fornendo un link su cui il client può cliccare, sia posizionandosi in un punto della rete per intercettare e controllare il flusso di dati tra client e server, ad esempio AiTM (adversary in the middle - CAPEC-94).
Creare una pagina web dannosa che appaia identica alla pagina target, ma instradi il traffico del client verso il server in modo che l'attaccante possa osservare il traffico e eseguire un attacco adversary in the middle.
Se l'attaccante ha accesso alla rete su cui si trovano il client o il server, può tentare di usare uno sniffer di pacchetti per eseguire un attacco adversary in the middle.
Installare uno sniffer di pacchetti tramite malware direttamente su un dispositivo client, in modo da intercettare il traffico SSL/TLS e eseguire un attacco adversary in the middle.
Attack Techniques
-
Install a packet sniffer through malware directly to a client device that can intercept SSL/TLS traffic and perform an adversary in the middle attack.
-
Create a malicious webpage that looks identical to the target webpage, but routes client traffic to the server such that the adversary can observe the traffic and perform an adverary in the middle attack.IT: Installare un packet sniffer tramite malware direttamente su un dispositivo client che possa intercettare il traffico SSL/TLS e eseguire un attacco man-in-the-middle.
-
If the adversary has access to the network that either the client or server is on, the can attempt to use a packet sniffer to perform an adversary in the middle attack.IT: Installare un packet sniffer tramite malware direttamente su un dispositivo client che possa intercettare il traffico SSL/TLS e eseguire un attacco man-in-the-middle.
3
Step 3
Exploit[Capture or Manipulate Sensitive Data] Once the adversary has the ability to intercept the secure communication, they exploit the incorrectly configured SSL to view the encrypted communication. The adversary can choose to just record the secure communication or manipulate the data to achieve a desired effect.
Use known exploits for old SSL and TLS versions.
Use known exploits for weak ciphers such as DES and RC4.
AI Translation
[Acquisizione o Manipolazione di Dati Sensibili] Una volta che l'avversario ha la capacità di intercettare la comunicazione sicura, sfrutta la configurazione errata di SSL per visualizzare la comunicazione crittografata. L'avversario può scegliere di semplicemente registrare la comunicazione sicura o manipolare i dati per ottenere un effetto desiderato.
Utilizzare exploit noti per versioni obsolete di SSL e TLS.
Utilizzare exploit noti per cifrature deboli come DES e RC4.
Attack Techniques
-
Use known exploits for old SSL and TLS versions.
-
Use known exploits for weak ciphers such as DES and RC4.IT: Utilizzare exploit noti per versioni obsolete di SSL e TLS.
Mitigations
3
Configure Tls To Use Secure Algorithms. The Current Recommendation Is To Use Ecdh, Ecdsa, Aes256-Gcm, And Sha384 For The Most Security.
Do Not Use Ssl, As All Ssl Versions Have Been Broken And Should Not Be Used. If Tls Is Not An Option For The Client Or Server, Consider Setting Timeouts On Ssl Sessions To Extremely Low Values To Lessen The Potential Impact.
Only Use Tls Version 1.2+, As Versions 1.0 And 1.1 Are Insecure.
Consequences
Security Scopes Affected
Access Control
Authorization
Confidentiality
Potential Impacts
Gain Privileges
Read Data
Relationships
Parent CAPECs
Resources Required
1
The adversary needs the ability to sniff traffic, and optionally be able to route said traffic to a system where the sniffing of traffic can take place, and act upon the recovered traffic in real time.