auren-research/cyber-sec huggingface dataset:
An attacker exploits two layers of weaknesses in server or client software for automated update mechanisms to undermine the integrity of the target code-base. The first weakness involves a failure to properly authenticate a server as a source of update or patch content. This type of weakness typically results from authentication mechanisms which can be defeated, allowing a hostile server to satisfy the criteria that establish a trust relationship. The second weakness is a systemic failure to validate the identity and integrity of code downloaded from a remote location, hence the inability to distinguish malicious code from a legitimate update.

One predominate type of redirection attack requires DNS spoofing or hijacking of a domain name corresponding to an update server. The target software initiates an update request and the DNS request resolves the domain name of the update server to the IP address of the attacker, at which point the software accepts updates either transmitted by or pulled from the attackers' server. Attacks against DNS mechanisms comprise an initial phase of a chain of attacks that facilitate automated update hijacking attack, and such attacks have a precedent in targeted activities that have been as complex as DNS/BIND attacks of corporate infrastructures, to untargeted attacks aimed at compromising home broadband routers, as well as attacks involving the compromise of wireless access points, as well as 'evil twin' attacks coupled with DNS redirection. Due to the plethora of options open to the attacker in forcing name resolution to arbitrary servers the Automated Update Hijacking attack strategies are the tip of the spear for many multi-stage attack chains.
The second weakness that is exploited by the attacker is the lack of integrity checking by the software in validating the update. Software which relies only upon domain name resolution to establish the identity of update code is particularly vulnerable, because this signals an absence of other security countermeasures that could be applied to invalidate the attackers' payload on basis of code identity, hashing, signing, encryption, and other integrity checking mechanisms. Redirection-based attack patterns work equally well against client-side software as well as local servers or daemons that provide software update functionality.

High
High

Access Control
Availability
Confidentiality
Execute Unauthorized Commands

1072
Software Deployment Tools

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Activation_Zone, Architectural_Paradigms, Injection_Vector, Payload, Payload_Activation_Impact, References, Technical_Context

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated @Name, Consequences, Description, Likelihood_Of_Attack, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

Malicious Automated Software Update
An adversary discovers the structure, function, and composition of an object, resource, or system by using a variety of analysis techniques to effectively determine how the analyzed entity was constructed or operates. The goal of reverse engineering is often to duplicate the function, or a part of the function, of an object in order to duplicate or "back engineer" some aspect of its functioning. Reverse engineering techniques can be applied to mechanical objects, electronic devices, or software, although the methodology and techniques involved in each type of analysis differ widely.
Low
Low

Access to targeted system, resources, and information.

Understanding of low level programming languages or technologies can be very helpful. For example, when reverse engineering a binary file, an understanding of assembly languages can help to determine the purpose and inner-workings of the code. Another example is reverse engineering an application that relies on networking. Here, an understanding networking protocols can provide insight into application details.

The technical resources necessary to engage in reverse engineering differ in accordance with the type of object, resource, or system being analyzed.

Employ code obfuscation techniques to prevent the adversary from reverse engineering the targeted entity.

When adversaries are reverse engineering software, methodologies fall into two broad categories, 'white box' and 'black box.' White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revealing at least a portion of its machine instructions that can be observed upon execution. 'Black Box' methods involve interacting with the software indirectly, in the absence of the ability to measure, instrument, or analyze an executable object directly. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Activation_Zone, Attacker_Skills_or_Knowledge_Required, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Related_Attack_Patterns, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Examples-Instances, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attacker_Skills_or_Knowledge_Required

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.
Low

Black box methods require (at minimum) the ability to interact with the functional boundaries where the software communicates with a larger processing environment, such as inter-process communication on a host operating system, or via networking protocols.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Activation_Zone, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description

Software Reverse Engineering
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
Medium

This attack is only applicable when a vulnerable entity associates data or services with an identity. Without such an association, there would be no reason to fake the source.

Resources required vary depending on the nature of the attack. Possible tools needed by an attacker could include tools to create custom network packets, specific client software, and tools to capture network traffic. Many variants of this attack require no attacker resources, however.

Integrity
Alter Execution Logic
By faking the source of data or services, an adversary can cause a target to make incorrect decisions about how to proceed.

Integrity
Gain Privileges
By impersonating identities that have an increased level of access, an adversary gain privilege that they many not have otherwise had.

Integrity
Hide Activities
Faking the source of data or services can be used to create a false trail in logs as the target will associate any actions with the impersonated identity instead of the adversary.

38
URL Redirector Abuse

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns
A Principal Spoof is a form of Identity Spoofing where an adversary pretends to be some other person in an interaction. This is often accomplished by crafting a message (either written, verbal, or visual) that appears to come from a person other than the adversary. Phishing and Pharming attacks often attempt to do this so that their attempts to gather sensitive information appear to come from a legitimate source. A Principal Spoof does not use stolen or spoofed authentication credentials, instead relying on the appearance and content of the message to reflect identity.

The possible outcomes of a Principal Spoof mirror those of Identity Spoofing. (e.g., escalation of privilege and false attribution of data or activities) Likewise, most techniques for Identity Spoofing (crafting messages or intercepting and replaying or modifying messages) can be used for a Principal Spoof attack. However, because a Principal Spoof is used to impersonate a person, social engineering can be both an attack technique (using social techniques to generate evidence in support of a false identity) as well as a possible outcome (manipulating people's perceptions by making statements or performing actions under a target's name).

Medium

The target must associate data or activities with a person's identity and the adversary must be able to modify this identity without detection.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Attack_Patterns
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
Low
Low

1
Explore
Determine the ciphertext and the encryption algorithm.

2
Experiment
Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense.

Ciphertext is known.
Encryption algorithm and key size are known.

Brute forcing encryption does not require much skill.

A powerful enough computer for the job with sufficient CPU, RAM and HD. Exact requirements will depend on the size of the brute force job and the time requirement for completion. Some brute forcing jobs may require grid or distributed computing (e.g. DES Challenge).
On average, for a binary key of size N, 2^(N/2) trials will be needed to find the key that would decrypt the ciphertext to obtain the original plaintext.
Obviously as N gets large the brute force approach becomes infeasible.

None. This attack happens offline.

Confidentiality
Read Data

Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.
In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

In 1997 the original DES challenge used distributed net computing to brute force the encryption key and decrypt the ciphertext to obtain the original plaintext. Each machine was given its own section of the key space to cover. The ciphertext was decrypted in 96 days.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Attack_Patterns, Related_Weaknesses
An attacker removes or disables filtering mechanisms on the target application. Input filters prevent invalid data from being sent to an application (for example, overly large inputs that might cause a buffer overflow or other malformed inputs that may not be correctly handled by an application). Input filters might also be designed to constrained executable content.

For example, if an application accepts scripting languages as input, an input filter could constrain the commands received and block those that the application's administrator deems to be overly powerful. An output filter screens responses from an application or person in order to prevent disclosure of sensitive information.
For example, an application's output filter might block output that is sourced to sensitive folders or which contains certain keywords. A data mask is similar to an output filter, but usually applies to structured data, such as found in databases. Data masks elide or replace portions of the information returned from a query in order to protect against the disclosure of sensitive information. If an input filter is removed the attacker will be able to send content to the target and have the target utilize it without it being sanitized. If the content sent by the attacker is executable, the attacker may be able to execute arbitrary commands on the target. If an output filter or data masking mechanism is disabled, the target may send out sensitive information that would otherwise be elided by the filters. If the data mask is disabled, sensitive information stored in a database would be returned unaltered. This could result in the disclosure of sensitive information, such as social security numbers of payment records.
This attack is usually executed as part of a larger attack series. The attacker would disable filters and would then mount additional attacks to either insert commands or data or query the target application in ways that would otherwise be prevented by the filters.

Medium

The target application must utilize some sort of filtering mechanism (input, output, or data masking).

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.
High
High

1
Explore
[Survey the target] Using a browser or an automated tool, an adversary records all instances of web services that process requests with serialized data.
Use an automated tool to record all instances of URLs that process requests with serialized data.
Use a browser to manually explore the website and analyze how the application processes serialized data requests.

2
Exploit
[Craft malicious payload] The adversary crafts malicious data message that contains references to sensitive files.

3
Exploit
[Launch an External Linking attack] Send the malicious crafted message containing the reference to a sensitive file to the target URL.

The target must follow external data references without validating the validity of the reference target.

To send serialized data messages with maliciously crafted schema.

None: No specialized resources are required to execute this type of attack.

Confidentiality
Read Data

Configure the serialized data processor to only retrieve external entities from trusted sources.

The following DTD would attempt to open the /dev/tty device:
<!DOCTYPE doc [ <!ENTITY ent SYSTEM "file:///dev/tty"> ]>
A malicious actor could use this crafted DTD to reveal sensitive information.

The following XML snippet would attempt to open the /etc/passwd file:
<foo xmlns:xi="http://www.w3.org/2001/XInclude"> <xi:include parse="text" href="file:///etc/passwd"/></foo>

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Activation_Zone, Attack_Phases, Attacker_Skills_or_Knowledge_Required, Description, Description Summary, Examples-Instances, Injection_Vector, Methods_of_Attack, Payload, Payload_Activation_Impact, Resources_Required, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Phases, Description Summary, Related_Attack_Patterns, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated @Name, Description, Execution_Flow, Mitigations, Skills_Required

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Consequences, Description

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Example_Instances, Execution_Flow, Prerequisites

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances, Related_Attack_Patterns

XML Entity Blowup
XML Entity Linking
An adversary creates a client application to interface with a target service where the client violates assumptions the service makes about clients. Services that have designated client applications (as opposed to services that use general client applications, such as IMAP or POP mail servers which can interact with any IMAP or POP client) may assume that the client will follow specific procedures.

For example, servers may assume that clients will accurately compute values (such as prices), will send correctly structured messages, and will attempt to ensure efficient interactions with the server. By reverse-engineering a client and creating their own version, an adversary can take advantage of these assumptions to abuse service functionality.
For example, a purchasing service might send a unit price to its client and expect the client to correctly compute the total cost of a purchase. If the adversary uses a malicious client, however, the adversary could ignore the server input and declare any total price. Likewise, an adversary could configure the client to retain network or other server resources for longer than legitimately necessary in order to degrade server performance. Even services with general clients can be susceptible to this attack if they assume certain client behaviors. However, such services generally can make fewer assumptions about the behavior of their clients in the first place and, as such, are less likely to make assumptions that an adversary can exploit.

Medium

The targeted service must make assumptions about the behavior of the client application that interacts with it, which can be abused by an adversary.

The adversary must be able to reverse engineer a client of the targeted service. However, the adversary does not need to reverse engineer all client functionality - they only need to recreate enough of the functionality to access the desired server functionality.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary exploits a weakness in authorization in order to modify content within a registry (e.g., Windows Registry, Mac plist, application registry). Editing registry information can permit the adversary to hide configuration information or remove indicators of compromise to cover up activity. Many applications utilize registries to store configuration and service information. As such, modification of registry information can affect individual services (affecting billing, authorization, or even allowing for identity spoofing) or the overall configuration of a targeted application. For example, both Java RMI and SOAP use registries to track available services. Changing registry values is sometimes a preliminary step towards completing another attack pattern, but given the long term usage of many registry values, manipulation of registry information could be its own end.
Medium

The targeted application must rely on values stored in a registry.
The adversary must have a means of elevating permissions in order to access and modify registry content through either administrator privileges (e.g., credentialed access), or a remote access tool capable of editing a registry through an API.

The adversary requires privileged credentials or the development/acquiring of a tailored remote access tool.

None: No specialized resources are required to execute this type of attack.

Ensure proper permissions are set for Registry hives to prevent users from modifying keys.
Employ a robust and layered defensive posture in order to prevent unauthorized users on your system.
Employ robust identification and audit/blocking using an allowlist of applications on your system. Unnecessary applications, utilities, and configurations will have a presence in the system registry that can be leveraged by an adversary through this attack pattern.

Manipulating registration information can be undertaken in advance of a path traversal attack (inserting relative path modifiers) or buffer overflow attack (enlarging a registry value beyond an application's ability to store it).

1112
Modify Registry

1647
Plist Modification

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated References

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Activation_Zone, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Examples-Instances, Injection_Vector, Payload, Payload_Activation_Impact, References, Related_Weaknesses, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Mitigations, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

Manipulate Application Registry Values