| 名称 |
Signature Spoof |
|
|
| 摘要 |
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions. |
| 前置条件 |
The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions. The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature. |
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-20 |
Improper Input Validation |
| CWE-290 |
Authentication Bypass by Spoofing |
| CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-151 |
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1036.001 |
Masquerading: Invalid Code Signature |
| 1553.002 |
Subvert Trust Controls: Code Signing |
|