auren-research/cyber-sec huggingface dataset:
An adversary inserts malicious logic into memory enabling them to achieve a negative impact. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems that are still under development and part of the supply chain.
Medium
High

Authorization
Execute Unauthorized Commands

Leverage anti-virus products to detect stop operations with known virus.

A USB Memory stick has malicious logic inserted before shipping of the product allowing for infection of the host machine once inserted into the USB port.
In 2007, approximately 1800 of Seagate's Maxtor Personal Storage 3200 drives were built under contract with an outside manufacturer and contained a virus that stole user passwords.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Description Summary, References

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Description Summary, Examples-Instances, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Attack_Patterns, Related_Weaknesses

Malicious Logic Insertion into Product Memory
An adversary inserts malicious logic into a product or technology via flashing the on-board memory with a code-base that contains malicious logic. Various attacks exist against the integrity of flash memory, the most direct being rootkits coded into the BIOS or chipset of a device.

Such attacks are very difficult to detect because the malicious code resides outside the filesystem or RAM, and in the underlying byte-code that drives the processor. Many devices, such as the recent attacks against digital picture frames, contain only a microprocessor and a small amount of solid-state memory, rendering these devices ideal for "flash" based malware or malicious logic.
One of the pernicious characteristics of flash memory based attacks is that the malicious code can survive even a total format of the hard-drive and reinstallation of the host operating system. Virtually any device which can be integrated into a computer system is susceptible to these attacks. Additionally, any peripheral device which interfaces with the computer bus could extract or sniff confidential data, even on systems employing full-disk encryption. Trojan code placed into a video card's chipset would continue to perform its function irrespective of the host operating system, and would be invisible to all known antivirus. The threats extend to consumer products such as camcorders, digital cameras, or any consumer electronic device with an embedded microcontroller.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
Medium

1
Explore
[Find User Input] The adversary finds anywhere in the web application that uses user-supplied input in a form or action. This can also be found by looking at parameters in the URL in the navigation bar of the browser

2
Experiment
[Add Duplicate Parameter Values] Once the adversary has identified what user input is used as HTTP parameters, they will add duplicates to each parameter one by one to observe the results. If the response from the HTTP request shows the duplicate parameter value concatenated with the original parameter value in some way, or simply just the duplicate parameter value, then HPP is possible.
In the URL, add a duplicate parameter by using the "&" delimiter. For example "par1=val1" becomes "par1=val1&par1=val2". Depending on the backend API, this could be treated as "par1=val1, val2", which could lead to par1 being set to val2, ignoring val1.
If the request is created based on user input directly on the page, the adversary will test by adding an encoded delimiter to the input. For example, the adverary might supply "1000%26action=withdraw" and the backend might interpret a POST request with the paramters "action=deposit&amount=1000&action=withdraw"

3
Exploit
[Leverage HPP] Once the adversary has identified how the backend handles duplicate parameters, they will leverage this by polluting the paramters in a way that benefits them. In some cases, hardcoded parameters will be disregarded by the backend. In others, the adversary can bypass a WAF that might only check a parameter before it has been concatenated by the backend, resulting in malicious queries getting through.

HTTP protocol is used with some GET/POST parameters passed

Any tool that enables intercepting and tampering with HTTP requests

Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests
Design: Perform URL encoding
Implementation: Use strict regular expressions in URL rewriting
Implementation: Beware of multiple occurrences of a parameter in a Query String

Web Parameter Tampering

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations, References, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Execution_Flow
An attacker creates a very persistent cookie that stays present even after the user thinks it has been removed. The cookie is stored on the victim's machine in over ten places. When the victim clears the cookie cache via traditional means inside the browser, that operation removes the cookie from certain places but not others. The malicious code then replicates the cookie from all of the places where it was not deleted to all of the possible storage locations once again. So the victim again has the cookie in all of the original storage locations. In other words, failure to delete the cookie in even one location will result in the cookie's resurrection everywhere. The evercookie will also persist across different browsers because certain stores (e.g., Local Shared Objects) are shared between different browsers.

The places a persistent cookie is stored on a victim's machine include: Standard HTTP Cookies, Local Shared Objects (Flash Cookies), Silverlight Isolated Storage, Storing cookies in RGB values of auto-generated, force-cached, PNGs using HTML5 Canvas tag to read pixels (cookies) back out, Storing cookies in Web History, Storing cookies in HTTP ETags, Storing cookies in Web cache, window.name caching, Internet Explorer userData storage, HTML5 Session Storage, HTML5 Local Storage, HTML5 Global Storage, HTML5 Database Storage via SQLite, among others.

Medium

The victim's browser is not configured to reject all cookiesThe victim visits a website that serves the attackers' evercookie

Evercookie source code

Design: Browser's design needs to be changed to limit where cookies can be stored on the client side and provide an option to clear these cookies in all places, as well as another option to stop these cookies from being written in the first place.
Design: Safari browser's private browsing mode is currently effective against evercookies.

1606.001
Forge Web Credentials: Web Cookies

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Description Summary, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.

Transparent proxies are often used by enterprises and ISPs. For requests originating at the client transparent proxies need to figure out the final destination of the client's data packet. Two ways are available to do that: either by looking at the layer three (network) IP address or by examining layer seven (application) HTTP header destination. A browser has same origin policy that typically prevents scripts coming from one domain initiating requests to other websites from which they did not come. To circumvent that, however, malicious Flash or an Applet that is executing in the user's browser can attempt to create a cross-domain socket connection from the client to the remote domain. The transparent proxy will examine the HTTP header of the request and direct it to the remote site thereby partially bypassing the browser's same origin policy. This can happen if the transparent proxy uses the HTTP host header information for addressing rather than the IP address information at the network layer. This attack allows malicious scripts inside the victim's browser to issue cross-domain requests to any hosts accessible to the transparent proxy.

Medium

Transparent proxy is usedVulnerable configuration of network topology involving the transparent proxy (e.g., no NAT happening between the client and the proxy)Execution of malicious Flash or Applet in the victim's browser

Creating malicious Flash or Applet to open a cross-domain socket connection to a remote system

Design: Ensure that the transparent proxy uses an actual network layer IP address for routing requests. On the transparent proxy, disable the use of routing based on address information in the HTTP host header.
Configuration: Disable in the browser the execution of Java Script, Flash, SilverLight, etc.

1090.001
Proxy: Internal Proxy

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings

Socket Capable Browser Plugins Result In Transparent Proxy Abuse
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).

There are many other ways in which the attacker may get the payload to execute in the victim's browser mainly by finding a way to hide it in some reputable site that the victim visits. The attacker could also send the link to the victim in an e-mail and trick the victim into clicking on the link. This attack is basically a cross site request forgery attack with two main differences. First, there is no action that is performed on behalf of the user aside from harvesting information. So standard CSRF protection may not work in this situation. Second, what is important in this attack pattern is the nature of the data being harvested, which is identifying information that can be obtained and used in context. This real time harvesting of identifying information can be used as a prelude for launching real time targeted social engineering attacks on the victim.

Low

The victim has an active session with the social networking site.

An attacker should be able to create a payload and deliver it to the victim's browser.
An attacker needs to know how to interact with various social networking sites (e.g., via available APIs) to request information and how to send the harvested data back to the attacker.

Usage: Users should always explicitly log out from the social networking sites when done using them.
Usage: Users should not open other tabs in the browser when using a social networking site.

An attacker may post a malicious posting that contains an image with an embedded link. The link actually requests identifying information from the social networking site. A victim who views the malicious posting in their browser will have sent identifying information to the attacker, as long as the victim had an active session with the social networking site.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Description, Example_Instances, Mitigations

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.

By having control of some text in the victim's domain, the attacker is able to inject a seemingly valid CSS string. It does not matter if this CSS string is preceded by other data. The CSS parser will still locate the CSS string. If the attacker is able to control two injection points, one before the cross domain data that the attacker is interested in receiving and the other one after, the attacker can use this attack to steal all of the data in between these two CSS injection points when referencing the injected CSS while performing rendering on the site that the attacker controls. When rendering, the CSS parser will detect the valid CSS string to parse and ignore the data that "does not make sense". That data will simply be rendered. That data is in fact the data that the attacker just stole cross domain. The stolen data may contain sensitive information, such CSRF protection tokens.

Medium

No new lines can be present in the injected CSS stringProper HTML or URL escaping of the " and ' characters is not presentThe attacker has control of two injection points: pre-string and post-string

Ability to craft a CSS injection

Attacker controlled site/page to render a page referencing the injected CSS string

Design: Prior to performing CSS parsing, require the CSS to start with well-formed CSS when it is a cross-domain load and the MIME type is broken. This is a browser level fix.
Implementation: Perform proper HTML encoding and URL escaping

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-11-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.
Low

HTTP protocol is usedWeb server used is vulnerable to denial of service via HTTP flooding

Ability to issues hundreds of HTTP requests

Configuration: Configure web server software to limit the waiting period on opened HTTP sessions
Design: Use load balancing mechanisms

1499.002
Endpoint Denial of Service: Service Exhaustion Flood

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
Low

Victim's browser visits a website that contains attacker's Java ScriptJava Script is not disabled in the victim's browser

Configuration: Disable Java Script in the browser

The following code snippets can be used to detect various browsers:

Firefox 2/3
FF=/a/[-1]=='a'
Firefox 3
FF3=(function x(){})[-5]=='x'
Firefox 2
FF2=(function x(){})[-6]=='x'
IE
IE='\v'=='v'
Safari
Saf=/a/.__proto__=='//'
Chrome
Chr=/source/.test((/a/.toString+''))
Opera
Op=/^function \(/.test([].sort)

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.

The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions.
The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature.

Technical understanding of how signature verification algorithms work with data and applications

Access Control
Authentication
Gain Privileges

An attacker provides a victim with a malicious executable disguised as a legitimate executable from an established software by signing the executable with a forged cryptographic key. The victim's operating system attempts to verify the executable by checking the signature, the signature is considered valid, and the attackers' malicious executable runs.
An attacker exploits weaknesses in a cryptographic algorithm to that allow a private key for a legitimate software vendor to be reconstructed, attacker-created malicious software is cryptographically signed with the reconstructed key, and is installed by the victim operating system disguised as a legitimate software update from the software vendor.

1036.001
Masquerading: Invalid Code Signature

1553.002
Subvert Trust Controls: Code Signing

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns, Taxonomy_Mappings
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Medium
High

An authoritative or reputable signer is storing their private signature key with insufficient protection.

Knowledge of common location methods and access methods to sensitive data
Ability to compromise systems containing sensitive data

Restrict access to private keys from non-supervisory accounts
Restrict access to administrative personnel and processes only
Ensure all remote methods are secured
Ensure all services are patched and up to date

1552.004
Unsecured Credentials: Private Keys

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Mitigations

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Taxonomy_Mappings
An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.
Low
High

Recipient is using signature verification software that does not clearly indicate potential homographs in the signer identity.Recipient is using signature verification software that contains a parsing vulnerability, or allows control characters in the signer identity field, such that a signature is mistakenly displayed as valid and from a known or authoritative signer.

Attacker needs to understand the layout and composition of data blobs used by the target application.
To discover a specific vulnerability, attacker needs to reverse engineer signature parsing, signature verification and signer representation code.
Attacker may be required to create malformed data blobs and know how to insert them in a location that the recipient will visit.

Ensure the application is using parsing and data display techniques that will accurately display control characters, international symbols and markings, and ultimately recognize potential homograph attacks.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses
An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
Low
High

Signer and recipient are using complex data storage structures that allow for a mix between signed and unsigned data
Recipient is using signature verification software that does not maintain separation between signed and unsigned data once the signature has been verified.

The attacker may need to continuously monitor a stream of signed data, waiting for an exploitable message to appear.
Attacker must be able to create malformed data blobs and know how to insert them in a location that the recipient will visit.

Ensure the application is fully patched and does not allow the processing of unsigned data as if it is signed data.

CAPEC Content Team
The MITRE Corporation
2014-06-23