auren-research/cyber-sec huggingface dataset:
An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.
Low
Medium

1
Explore
[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic.
Research popular or high traffic websites.

2
Experiment
[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the BitSquatted URL.
Register the BitSquatted domain.

3
Exploit
[Wait for a user to visit the domain] Finally, the adversary simply waits for a user to be unintentionally directed to the BitSquatted domain.
Simply wait for an error in memory to occur, redirecting the user to the malicious domain.

An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

Adversaries must be able to register DNS hostnames/URL’s.

Other
Other
Depending on the intention of the adversary, a successful BitSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials.

Authenticate all servers and perform redundant checks when using DNS hostnames.
When possible, use error-correcting (ECC) memory in local devices as non-ECC memory is significantly more vulnerable to faults.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Description, Description Summary, Methods_of_Attack, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Phases

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.
Low

None

Open source and commercial software tools are available and several commercial advertising companies routinely set up tools to collect and monitor MAC addresses.

Automatic randomization of WiFi MAC addresses
Frequent changing of handset and retransmission device

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then scan for this SSID to track that user in the future.
Low

None

Open source and commercial software tools are available and open databases of known WiFi SSID addresses are available online.

Do not enable the feature of "Hidden SSIDs" (also known as "Network Cloaking") – this option disables the usual broadcasting of the SSID by the access point, but forces the mobile handset to send requests on all supported radio channels which contains the SSID. The result is that tracking of the mobile device becomes easier since it is transmitting the SSID more frequently.
Frequently change the SSID to new and unrelated values

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Mitigations
SIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets. This attack leverages over-the-air (OTA) updates deployed via cryptographically-secured SMS messages to deliver executable code to the SIM. By cracking the DES key, an attacker can send properly signed binary SMS messages to a device, which are treated as Java applets and are executed on the SIM. These applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.
High

A SIM card that relies on the DES cipher.

This is a sophisticated attack, but detailed techniques are published in open literature.

Confidentiality
Integrity
Execute Unauthorized Commands

Upgrade the SIM card to use the state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns

Rooting SIM CardS
Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversary-in-the-middle" (CAPEC-94) for all communications.
Low

None

Confidentiality
Read Data
Intercept and control Wi-Fi data communications to/from mobile device.

Commercial defensive technology that monitors for rogue Wi-Fi access points, adversary-in-the-middle attacks, and anomalous activity with the mobile device baseband radios.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Description, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description, Mitigations

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.
Medium
Medium

A resource is expected to available to the user.

Adversaries can often purchase low-cost technology to implement rogue access points.

Confidentiality
Integrity
Other
Successful attacks of this nature can result in a wide variety of consequences and negatively impact confidentiality and integrity based on the adversary's subsequent actions.

1036.005
Masquerading: Match Legitimate Name or Location

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Related_Weaknesses, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns, Taxonomy_Mappings

Patiently Waiting at Incorrect Location
In this attack scenario, the attacker imitates a cellular base station with their own "rogue" base station equipment. Since cellular devices connect to whatever station has the strongest signal, the attacker can easily convince a targeted cellular device (e.g. the retransmission device) to talk to the rogue base station.
Low

None

This technique has been demonstrated by amateur hackers and commercial tools and open source projects are available to automate the attack.

Confidentiality
Read Data
Intercept and control cellular data communications to/from mobile device.

Passively monitor cellular network connection for real-time threat detection and logging for manual review.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Description, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns
In this attack scenario, the attacker uses knowledge of the target’s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobile device. Since the network knows which cell tower the target’s mobile device is attached to, the broadcast messages are only sent in the Location Area Code (LAC) where the target is currently located. By triggering the cellular broadcast message and then listening for the presence or absence of that message, an attacker could verify that the target is in (or not in) a given location.
Low

The attacker must have knowledge of the target’s mobile phone number.

Open source and commercial tools are available for this attack.

Other
Other
An attacker could verify that the target is in (or not in) a given location.

Frequent changing of mobile number.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Description Summary, References
In this attack scenario, the attacker passively monitors the signal strength of the target’s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) to identify the source location of the signal. Obtaining the signal of the target can be accomplished through multiple techniques such as through Cellular Broadcast Message Request or through the use of IMSI Tracking or WiFi MAC Address Tracking.
Low

Commercial tools are available.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.
High

Access Control
Bypass Protection Mechanism

1600
Weaken Encryption

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An attacker may intercept and log encrypted transmissions for the purpose of analyzing metadata such as packet timing and sizes. Although the actual data may be encrypted, this metadata may reveal valuable information to an attacker. Note that this attack is applicable to VOIP data as well as application data, especially for interactive apps that require precise timing and low-latency (e.g. thin-clients).
Low

Use of untrusted communication paths enables an attacker to intercept and log communications, including metadata such as packet timing and sizes.

These attacks generally require sophisticated machine learning techniques and require traffic capture as a prerequisite.

Confidentiality
Read Data
Derive sensitive information about encrypted data.

Distort packet sizes and timing at VPN layer by adding padding to normalize packet sizes and timing delays to reduce information leakage via timing.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
In this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing. From these emanations, the attacker derives information about the data that is being processed (e.g. the attacker can recover cryptographic keys by monitoring emanations associated with cryptographic processing). This style of attack requires proximal access to the device, however attacks have been demonstrated at public conferences that work at distances of up to 10-15 feet. There have not been any significant studies to determine the maximum practical distance for such attacks. Since the attack is passive, it is nearly impossible to detect and the targeted device will continue to operate as normal after a successful attack.
Low

Proximal access to the device.

Sophisticated attack, but detailed techniques published in the open literature.

Confidentiality
Read Data
Derive sensitive information about encrypted data. For mobile devices, depending on which keys are compromised, the attacker may be able to decrypt VOIP communications, impersonate the targeted caller, or access the enterprise VPN server.

Utilize side-channel resistant implementations of all crypto algorithms.
Strong physical security of all devices that contain secret key information. (even when devices are not in use)

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
Compromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment. Commercial mobile devices and retransmission devices have displays, buttons, microchips, and radios that emit mechanical emissions in the form of sound or vibrations. Capturing these emissions can help an adversary understand what the device is doing.
Low

Proximal access to the device.

Sophisticated attack.

Confidentiality
Read Data
Capture vibrations/emissions from the handset or retransmission device display screen to recreat display information from a distance.

None are known.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.

Side-Channel Attack

Low
High

Physical access to the system
The adversary must be cognizant of where fault injection vulnerabilities exist in the system in order to leverage them for exploitation.

Adversaries require non-trivial technical skills to create and implement fault injection attacks. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required.

The relevant sensors and tools to detect and analyze fault/side-channel data from a system.
A tool capable of injecting fault/side-channel data into a system or application.

Confidentiality
Read Data
Bypass Protection Mechanism
Hide Activities
An adversary capable of successfully collecting and analyzing sensitive, fault/side-channel information, has compromised the confidentiality of that application or information system data.

Integrity
Execute Unauthorized Commands
If an adversary is able to inject data via a fault or side channel vulnerability towards malicious ends, the integrity of the application or information system will be compromised.

Implement robust physical security countermeasures and monitoring.

Considerable effort on the part of the adversary is often required in order to detect and analyze fault/side channel data.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Alternate_Terms, Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Other_Notes, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Prerequisites

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated @Name, Consequences, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Related_Weaknesses

Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Adversaries require non-trivial technical skills to create and implement fault injection attacks on mobile devices. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required. This prerequisite makes the attack challenging to perform (assuming that physical security countermeasures and monitoring are in place).

Confidentiality
Access Control
Read Data
Extract long-term secret keys (e.g. keys used for VPN or WiFi authentication and encryption) to enable decryption of intercepted VOIP traffic.

Strong physical security of all devices that contain secret key information. (even when devices are not in use)
Frequent changes to secret keys and certificates.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
Attacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user’s fingers.

The attacker must have physical access to the device.

The attacker must know how to make use of these smudges.

Access Control
Bypass Protection Mechanism

Strong physical security of the device.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attacker_Skills_or_Knowledge_Required

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
An adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These spoofed signals may be structured in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the adversary.
Low
High

The target must be relying on valid GPS signal to perform critical operations.

The ability to spoof GPS signals is not trival.

Ability to create spoofed GPS signals.

Integrity
Modify Data

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns
A common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. Over time, the adversary can carry the target away from their intended destination and toward a location chosen by the adversary.
Low
High

The target must be relying on valid GPS signal to perform critical operations.

This attack requires advanced knoweldge in GPS technology.

A "proof-of-concept" attack was successfully performed in June, 2013, when the luxury yacht "White Rose" was misdirected with spoofed GPS signals from Monaco to the island of Rhodes by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attacker_Skills_or_Knowledge_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns
This attack pattern has been deprecated.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attacker_Skills_or_Knowledge_Required, Description Summary

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated @Name, @Status, Description, Related_Attack_Patterns, Related_Weaknesses, Skills_Required

Unauthorized Use of Device Resources