CAPEC-145: Checksum Spoofing | RadicalNotion.AI

Overview

CAPEC-145 (Checksum Spoofing) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The adversary must be able to intercept a message from the sender (keeping the recipient from getting it), modify it, and send the modified message to the recipient.
The sender and recipient must use a checksum to protect the integrity of their message and transmit this checksum in a manner where the adversary can intercept and modify it.
The checksum value must be computable using information known to the adversary. A cryptographic checksum, which uses a key known only to the sender and recipient, would thwart this attack.

Resources required

The adversary must have a utility that can intercept and modify messages between the sender and recipient.

The CWE weaknesses that CAPEC-145 exploits.

CWE-354: Improper Validation of Integrity Check Value

How this attack relates to others in the CAPEC hierarchy.

Parent

CAPEC-148: Content Spoofing

Frequently asked questions

Common questions about CAPEC-145.

What is CAPEC-145?

An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute different checksum values. Since the sender's checksum value is transmitted with the message, the recipient would know that a modification occurred. In checksum spoofing an adversary modifies the message body and then modifies the corresponding checksum so that the recipient's checksum calculation will match the checksum (created by the adversary) in the message. This would prevent the recipient from realizing that a change occurred.

What weaknesses does CAPEC-145 target?

CAPEC-145 exploits 1 CWE weakness, including CWE-354 (Improper Validation of Integrity Check Value).

How severe is CAPEC-145?

MITRE rates CAPEC-145 as Medium severity.

References

MITRE CAPEC definition (CAPEC-145) (opens in a new tab)

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.