auren-research/cyber-sec huggingface dataset:
An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.

Availability
Other
Preventing DNS from resolving a request denies the availability of a target site or service for the user.

Hard Coded Alternate DNS server in applications
Avoid dependence on DNS
Include "hosts file"/IP address in the application.
Ensure best practices with respect to communications channel protections.
Use a .onion domain with Tor support

Full URL Based Filtering: Filtering based upon the requested URL.
URL String-based Filtering: Filtering based upon the use of particular strings included in the requested URL.

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations
An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.
Low
High

This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.

Availability
Other
Blocking packets intended for a target IP address denies its availability to the user.

Have a large pool of backup IPs built into the application and support proxy capability in the application.

Consider situations of information censorship for political purposes, where regimes that prevent access to specific web services.

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Related_Vulnerabilities

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns, Related_Weaknesses
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
High
Very High

1
Explore
[Discover Existing Session Token] Through varrying means, an adversary will discover and store an existing session token for some other authenticated user session.

2
Experiment
[Insert Found Session Token] The attacker attempts to insert a found session token into communication with the targeted application to confirm viability for exploitation.

3
Exploit
[Session Token Exploitation] The attacker leverages the captured session token to interact with the targeted application in a malicious fashion, impersonating the victim.

An application that leverages sessions to perform authentication.

Exploiting a poorly protected identity token is a well understood attack with many helpful resources available.

The adversary must have the ability to communicate with the application over the network.

Confidentiality
Integrity
Availability
Gain Privileges
A successful attack can enable an adversary to gain unauthorized access to an application.

Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf. Utilize a session timeout for all sessions. If the user does not explicitly logout, terminate their session after this period of inactivity. If the user logs back in then a new session key should be generated.

1185
Browser Session Hijacking

1550.001
Use Alternate Authentication Material:Application Access Token

1563
Remote Service Session Hijacking

Session hijacking attack

CAPEC Content Team
The MITRE Corporation
2017-04-15

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Examples-Instances, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated References, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Execution_Flow

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.

The target application must leverage an open communications channel.
The channel on which the target communicates must be vulnerable to interception (e.g., adversary in the middle attack - CAPEC-94).

A tool, such as a MITM Proxy, that is capable of generating and injecting custom inputs to be used in the attack.

Availability
Unreliable Execution
The injection of specific content into a connection can trigger a disruption in that communications channel, thereby denying availability of the service.

Integrity
Other
An adversary's injection of additional content into a communication channel negatively impacts the integrity of that channel.

Seamus Tuohy
2017-01-03

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Prerequisites
In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.

This attack requires the ability to monitor the target's network connection.

Seamus Tuohy
2017-01-04

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
An adversary sends a malicious ("NXDOMAIN" ("No such domain") code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to the target's DNS requests. This attack differs from BGP Tampering in that it directly responds to requests made by the target instead of polluting the routing the target's infrastructure uses.

On/In Path Device

To distribute email

Design: Avoid dependence on DNS
Design: Include "hosts file"/IP address in the application
Implementation: Utilize a .onion domain with Tor support
Implementation: DNSSEC
Implementation: DNS-hold-open

Below-Recursive DNS Poisoning: When an On/In-path device between a recursive DNS server and a user sends a malicious ("NXDOMAIN" ("No such domain") code, or DNS A record ) response before a legitimate resolver can.
Above-Recursive DNS Poisoning: When an On/In-path device between an authority server (e.g., government-managed) and a recursive DNS server sends a malicious ("NXDOMAIN" ("No such domain")code, or a DNS record) response before a legitimate resolver can.

Seamus Tuohy
2017-01-04

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Description
In this attack pattern, the adversary transmits disruptive signals in the direction of the target's consumer-level satellite dish (as opposed to the satellite itself). The transmission disruption occurs in a more targeted range. Portable terrestrial jammers have a range of 3-5 kilometers in urban areas and 20 kilometers in rural areas. This technique requires a terrestrial jammer that is more powerful than the frequencies sent from the satellite.
Low
High

A terrestrial satellite jammer with a signal more powerful than that of the satellite attempting to communicate with the target.
The adversary must know the location of the target satellite dish.

Availability
Other
A successful attack will deny, degrade, or disrupt availability of satellite communications for the target by overwhelming its resources to accurately receive authorized transmissions.

An attempt to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These jamming signals may be structured in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the adversary.

Seamus Tuohy
2017-01-12

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Description, Related_Attack_Patterns
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
High
High

1
Explore
The attacker interacts with the target host and finds that session IDs are used to authenticate users.

2
Explore
The attacker steals a session ID from a valid user.

3
Exploit
The attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner.

The target host uses session IDs to keep track of the users.
Session IDs are used to control access to resources.
The session IDs used by the target host are not well protected from session theft.

If an attacker can steal a valid session ID, they can then try to be authenticated with that stolen session ID.
More sophisticated attack can be used to hijack a valid session from a user and spoof a legitimate user by reusing their valid session ID.

Confidentiality
Access Control
Authorization
Gain Privileges

Always invalidate a session ID after the user logout.
Setup a session time out for the session IDs.
Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate adversary in the middle attacks (CAPEC-94).
Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.
Encrypt the session data associated with the session ID.
Use multifactor authentication.

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428
Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258

1134.001
Access Token Manipulation:Token Impersonation/Theft

1550.004
Use Alternate Authentication Material:Web Session Cookie

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Skills_Required, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Mitigations, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An adversary uses radio noise or signals in an attempt to disrupt communications. By intentionally overwhelming system resources with illegitimate traffic, service is denied to the legitimate traffic of authorized users.
Medium
High

Availability
Other
The jamming of equipment denies the availability of functioning communications services.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Description Summary, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
An adversary blocks the delivery of an important system resource causing the system to fail or stop working.
Medium
High

This attack pattern requires knowledge of where important system resources are logically located as well as how they operate.

Availability
Other
Blocking a resource from functional operation denies its availability to authorized users.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns
In this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network. There are several known techniques to perform this attack – for example: the attacker may flood the Wi-Fi access point (e.g. the retransmission device) with deauthentication frames. Another method is to transmit high levels of noise on the RF band used by the Wi-Fi network.
Medium
High

Lack of anti-jam features in 802.11
Lack of authentication on deauthentication/disassociation packets on 802.11-based networks

This attack can be performed by low capability attackers with freely available tools. Commercial tools are also available that can target select networks or all WiFi networks within a range of several miles.

Availability
Other
A successful attack will deny the availability of the Wi-fi network to authorized users.

Availability
Resource Consumption
The attacker's goal is to prevent users from accessing the wireless network. Denying connectivity to the wireless network prevents the user from being able to transmit or receive any data, which also prevents VOIP calls, however this attack poses no threat to data confidentiality.

Countermeasures have been proposed for both disassociation flooding and RF jamming, however these countermeasures are not standardized and would need to be supported on both the retransmission device and the handset in order to be effective. Commercial products are not currently available that support jamming countermeasures for Wi-Fi.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences, Related_Vulnerabilities, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
In this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower. Several existing techniques are known in the open literature for this attack for 2G, 3G, and 4G LTE cellular technology. For example, some attacks target cell towers by overwhelming them with false status messages, while others introduce high levels of noise on signaling channels.
Low

Lack of anti-jam features in cellular technology (2G, 3G, 4G, LTE)

This attack can be performed by low capability attackers with commercially available tools.

Availability
Resource Consumption
The attacker's goal is to prevent users from accessing the cellular network. Denying connectivity to the cellular network prevents the user from being able to transmit or receive any data, which also prevents VOIP calls, however this attack poses no threat to data confidentiality.

Mitigating this attack requires countermeasures employed on both the retransmission device as well as on the cell tower. Therefore, any system that relies on existing commercial cell towards will likely be vulnerable to this attack. By using a private cellular LTE network (i.e., a custom cell tower), jamming countermeasures could be developed and employed.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode).
High

Cellular devices that allow negotiating security modes to facilitate backwards compatibility and roaming on legacy networks.

Adversaries can purchase and implement rogue BTS stations at a cost effective rate, and can push a mobile device to downgrade to a non-secure cellular protocol like 2G over GSM or CDMA.

Confidentiality
Other
Tracking, Network Reconnaissance

Use of hardened baseband firmware on retransmission device to detect and prevent the use of weak cellular encryption.
Monitor cellular RF interface to detect the usage of weaker-than-expected cellular encryption.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences
An attacker obstructs the interactions between system components. By interrupting or disabling these interactions, an adversary can often force the system into a degraded state or cause the system to stop working as intended. This can cause the system components to be unavailable until the obstruction mitigated.

Availability
Resource Consumption

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Description Summary

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Description
The use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content. Some cellular encryption algorithms such as A5/1 and A5/2 (specified for GSM use) are known to be vulnerable to such attacks and commercial tools are available to execute these attacks and decrypt mobile phone conversations in real-time. Newer encryption algorithms in use by UMTS and LTE are stronger and currently believed to be less vulnerable to these types of attacks. Note, however, that an attacker with a Cellular Rogue Base Station can force the use of weak cellular encryption even by newer mobile devices.
High

None

Adversaries can rent commercial supercomputer time globally to conduct cryptanalysis on encrypted data captured from mobile devices. Foreign governments have their own cryptanalysis technology and capabilities. Commercial cellular standards for encryption (GSM and CDMA) are also subject to adversary cryptanalysis.

Confidentiality
Other
Reveals IMSI and IMEI for tracking of retransmission device and enables further follow-on attacks by revealing black network control messages. (e.g., revealing IP addresses of enterprise servers for VOIP connectivity)

Use of hardened baseband firmware on retransmission device to detect and prevent the use of weak cellular encryption.
Monitor cellular RF interface to detect the usage of weaker-than-expected cellular encryption.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns
Cellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Additionally, government agencies of adversaries and malicious actors can intercept cellular traffic via the telecommunications backbone over which mobile traffic is transmitted.
Low

None

Adversaries can purchase hardware and software solutions, or create their own solutions, to capture/intercept cellular radio traffic. The cost of a basic Base Transceiver Station (BTS) to broadcast to local mobile cellular radios in mobile devices has dropped to very affordable costs. The ability of commercial cellular providers to monitor for "rogue" BTS stations is poor in many areas and it is assumed that "rogue" BTS stations exist in urban areas.

Confidentiality
Read Data
Capture all cellular and RF traffic from mobile and retransmission devices. Move bulk traffic capture to storage area for cryptanalysis of encrypted traffic, and telemetry analysis of non-encrypted data. (packet headers, cellular power data, signal strength, etc.)

Encryption of all data packets emanating from the smartphone to a retransmission device via two encrypted tunnels with Suite B cryptography, all the way to the VPN gateway at the datacenter.

1111
Multi-Factor Authentication Interception

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns, Skills_Required

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
Adversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.
High

None

Often achieved by nation states in conjunction with commercial cellular providers to conduct cellular traffic intercept and possible traffic injection.

Availability
Resource Consumption
Attackers can disrupt or deny mobile technology communications and operations.

Availability
Modify Data
Attackers can inject false data into data or signaling system data flows of communications and operations, or re-route data flows or signaling data for the purpose of further data intercept and capture.

Commercial defensive technology to detect and alert to any attempts to modify mobile technology data flows or to inject new data into existing data flows and signaling data.

CAPEC Content Team
The MITRE Corporation
2015-11-09

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Motivation-Consequences

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction