{'xhtml:p': 'An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.'}
Description
Attack Execution Flow
3
1
Step 1
Explore[Determine Communication Mechanism] The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit.
Perform a sniffing attack and observe communication to determine a communication protocol.
Look for application documentation that might describe a communication mechanism used by a target.
AI Translation
[Determina il Meccanismo di Comunicazione] L'adversary determina la natura e il meccanismo di comunicazione tra due componenti, cercando opportunità da sfruttare.
Esegui un attacco di sniffing e osserva la comunicazione per determinare un protocollo di comunicazione.
Cerca documentazione dell'applicazione che possa descrivere un meccanismo di comunicazione utilizzato da un obiettivo.
Attack Techniques
-
Perform a sniffing attack and observe communication to determine a communication protocol.
-
Look for application documentation that might describe a communication mechanism used by a target.IT: Eseguire un attacco di sniffing e osservare le comunicazioni per determinare un protocollo di comunicazione.
2
Step 2
Experiment[Position In Between Targets] The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.
Install spyware on a client that will intercept outgoing packets and route them to their destination as well as route incoming packets back to the client.
Exploit a weakness in an encrypted communication mechanism to gain access to traffic. Look for outdated mechanisms such as SSL.
AI Translation
[Posizione tra gli Obiettivi] L'avversario si inserisce nel canale di comunicazione inizialmente agendo come proxy di routing tra i due componenti target.
Installare spyware su un client che intercetterà i pacchetti in uscita e li reindirizzerà alla loro destinazione, così come reindirizzerà i pacchetti in ingresso al client.
Sfruttare una vulnerabilità in un meccanismo di comunicazione crittografata per ottenere accesso al traffico. Cercare meccanismi obsoleti come SSL.
Attack Techniques
-
Install spyware on a client that will intercept outgoing packets and route them to their destination as well as route incoming packets back to the client.
-
Exploit a weakness in an encrypted communication mechanism to gain access to traffic. Look for outdated mechanisms such as SSL.IT: Installare spyware su un client che intercetti i pacchetti in uscita e li reindirizzi alla loro destinazione, nonché instradi i pacchetti in arrivo indietro al client.
3
Step 3
Exploit[Use Intercepted Data Maliciously] The adversary observes, filters, or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.
Prevent some messages from reaching their destination, causing a denial of service.
AI Translation
[Utilizzo di Dati Intercettati in modo Malevolo] L'avversario osserva, filtra o altera i dati trasmessi a suo piacimento per ottenere accesso a informazioni sensibili o per manipolare le azioni dei due componenti target a proprio vantaggio.
Impedisce ad alcuni messaggi di raggiungere la loro destinazione, causando un denial of service.
Attack Techniques
-
Prevent some messages from reaching their destination, causing a denial of service.
Mitigations
4
Encrypt Communications Using Cryptography (E.G., Ssl/Tls)
Ensure Public Keys Are Signed By A Certificate Authority
Exchange Public Keys Using A Secure Channel
Use Strong Mutual Authentication To Always Fully Authenticate Both Ends Of Any Communications Channel.
Consequences
Security Scopes Affected
Access Control
Authorization
Confidentiality
Integrity
Potential Impacts
Gain Privileges
Modify Data
Read Data
Relationships
Child CAPECs
CAPEC-219
XML Routing Detour Attacks
CAPEC-384
Application API Message Manipulation via Man-in-the-Middle
CAPEC-386
Application API Navigation Remapping
CAPEC-466
Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
CAPEC-662
Adversary in the Browser (AiTB)
CAPEC-701
Browser in the Middle (BiTM)
Related ATT&CK Techniques
1
T1557
Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on …