| 名称 |
Sniff Application Code |
|
|
| 摘要 |
An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server. |
| 前置条件 |
The attacker must have the ability to place themself in the communication path between the client and server. The targeted application must receive some application code from the server; for example, dynamic updates, patches, applets or scripts. The attacker must be able to employ a sniffer on the network without being detected. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Explore |
[Set up a sniffer] The adversary sets up a sniffer in the path between the server and the client and watches the traffic. |
- The adversary sets up a sniffer in the path between the server and the client.
|
| 2 |
Exploit |
[Capturing Application Code Bound During Patching]adversary knows that the computer/OS/application can request new applications to install, or it periodically checks for an available update. The adversary loads the sniffer set up during Explore phase, and extracts the application code from subsequent communication. The adversary then proceeds to reverse engineer the captured code. |
- adversary loads the sniffer to capture the application code bound during a dynamic update.
- The adversary proceeds to reverse engineer the captured code.
|
|
| 解决方案 | Design: Encrypt all communication between the client and server. Implementation: Use SSL, SSH, SCP. Operation: Use "ifconfig/ipconfig" or other tools to detect the sniffer installed in the network. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-311 |
Missing Encryption of Sensitive Data |
| CWE-318 |
Cleartext Storage of Sensitive Information in Executable |
| CWE-319 |
Cleartext Transmission of Sensitive Information |
| CWE-693 |
Protection Mechanism Failure |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-37 |
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack. |
| CAPEC-157 |
In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1040 |
Network Sniffing |
|