CAPEC-117: Interception

Abstraction

Overview

CAPEC-117 (Interception) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The target must transmit data over a medium that is accessible to the adversary.

Resources required

The adversary must have the necessary technology to intercept information passing between the nodes of a network. For TCP/IP, the capability to run tcpdump, ethereal, etc. can be useful. Depending upon the data being targeted the technological requirements will change.

Consequences

What a successful CAPEC-117 attack can achieve.

Read Data

Affects: Confidentiality

How to mitigate it

Defenses that reduce the risk of CAPEC-117.

Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.

Frequently asked questions

Common questions about CAPEC-117.

What is CAPEC-117?

An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position themself so as to observe explicit data channels (e.g. network traffic) and read the content. However, this attack differs from a Adversary-In-the-Middle (CAPEC-94) attack, as the adversary does not alter the content of the communications nor forward data to the intended recipient.

How do you prevent CAPEC-117?

Leverage encryption to encode the transmission of data thus making it accessible only to authorized parties.

What weaknesses does CAPEC-117 target?

CAPEC-117 exploits 1 CWE weakness, including CWE-319 (Cleartext Transmission of Sensitive Information).

How severe is CAPEC-117?

MITRE rates CAPEC-117 as Medium severity with low likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-117

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing