CAPEC-297: TCP ACK Ping | RadicalNotion.AI

Overview

CAPEC-297 (TCP ACK Ping) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The ability to send an ACK packet to a remote host and identify the response. Creating the ACK packet without building a full connection requires the use of raw sockets. As a result, it is not possible to send a TCP ACK ping from some systems (Windows XP SP 2) without the use of third-party packet drivers like Winpcap. On other systems (BSD, Linux) administrative privileges are required in order to write to the raw socket.
The target must employ a stateless firewall that lacks a rule set that rejects unsolicited ACK packets.
The adversary requires the ability to craft custom TCP ACK segments for use during network reconnaissance. Sending an ACK ping requires the ability to access "raw sockets" in order to create the packets with direct access to the packet header.

Resources required

ACK scanning can be performed via the use of a port scanner or by raw socket manipulation using a scripting or programming language. Packet injection tools are also useful for this purpose. Depending upon the technique used it may also be necessary to sniff the network in order to see the response.

Consequences

What a successful CAPEC-297 attack can achieve.

Other

Affects: Confidentiality

Bypass Protection Mechanism, Hide Activities

Affects: Confidentiality, Access Control, Authorization

How to mitigate it

Defenses that reduce the risk of CAPEC-297.

Leverage stateful firewalls that allow for the rejection of a packet that is not part of an existing connection.

The CWE weaknesses that CAPEC-297 exploits.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

How this attack relates to others in the CAPEC hierarchy.

Parent

CAPEC-292: Host Discovery

Frequently asked questions

Common questions about CAPEC-297.

What is CAPEC-297?

An adversary sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host is alive. This is one of several TCP 'ping' types. The RFC 793 expected behavior for a service is to respond with a RST 'reset' packet to any unsolicited ACK segment that is not part of an existing connection. So by sending an ACK segment to a port, the adversary can identify that the host is alive by looking for a RST packet. Typically, a remote server will respond with a RST regardless of whether a port is open or closed. In this way, TCP ACK pings cannot discover the state of a remote port because the behavior is the same in either case. The firewall will look up the ACK packet in its state-table and discard the segment because it does not correspond to any active connection. A TCP ACK Ping can be used to discover if a host is alive via RST response packets sent from the host.

How do you prevent CAPEC-297?

Leverage stateful firewalls that allow for the rejection of a packet that is not part of an existing connection.

What weaknesses does CAPEC-297 target?

CAPEC-297 exploits 1 CWE weakness, including CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How severe is CAPEC-297?

MITRE rates CAPEC-297 as Low severity.

References

MITRE CAPEC definition (CAPEC-297) (opens in a new tab)

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.