CAPEC-192: Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
Last updated
Overview
Although certain techniques for protocol analysis benefit from manipulating live 'on-the-wire' interactions between communicating components, static or dynamic analysis techniques applied to executables as well as to device drivers, such as network interface drivers, can also be used to reveal the function and characteristics of a communication protocol implementation. Depending upon the methods used the process may involve observing, interacting, and modifying actual communications occurring between hosts. The goal of protocol analysis is to derive the data transmission syntax, as well as to extract the meaningful content, including packet or content delimiters used by the protocol. This type of analysis is often performed on closed-specification protocols, or proprietary protocols, but is also useful for analyzing publicly available specifications to determine how particular implementations deviate from published specifications.
What the attacker needs
Prerequisites
- Access to a binary executable.
- The ability to observe and interact with a communication channel between communicating processes.
Skills required
- High skill: Knowlegde of the Open Systems Interconnection model (OSI model), and famililarity with Wireshark or some other packet analyzer.
Resources required
- Depending on the type of analysis, a variety of tools might be required, such as static code and/or dynamic analysis tools. Alternatively, the effort might require debugging programs such as ollydbg, SoftICE, or disassemblers like IDA Pro. In some instances, packet sniffing or packet analyzing programs such as TCP dump or Wireshark are necessary. Lastly, specific protocol analysis might require tools such as PDB (Protocol Debug), or packet injection tools like pcap or Nemesis.
Consequences
What a successful CAPEC-192 attack can achieve.
Read Data
Affects: Confidentiality
Successful deciphering of protocol information compromises the confidentiality of future sensitive communications.
Modify Data
Affects: Integrity
Modifying communications after successful deciphering of protocol information compromises integrity.
Frequently asked questions
Common questions about CAPEC-192.
- What is CAPEC-192?
- An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
- What weaknesses does CAPEC-192 target?
- CAPEC-192 exploits 1 CWE weakness, including CWE-326 (Inadequate Encryption Strength).
- How severe is CAPEC-192?
- MITRE rates CAPEC-192 as Low severity with low likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-192
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.