CAPEC-473: Signature Spoof
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
Last updated
Overview
CAPEC-473 (Signature Spoof) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions.
- The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature.
Skills required
- High skill: Technical understanding of how signature verification algorithms work with data and applications
Consequences
What a successful CAPEC-473 attack can achieve.
Gain Privileges
Affects: Access Control, Authentication
Examples
An attacker provides a victim with a malicious executable disguised as a legitimate executable from an established software by signing the executable with a forged cryptographic key. The victim's operating system attempts to verify the executable by checking the signature, the signature is considered valid, and the attackers' malicious executable runs.
An attacker exploits weaknesses in a cryptographic algorithm to that allow a private key for a legitimate software vendor to be reconstructed, attacker-created malicious software is cryptographically signed with the reconstructed key, and is installed by the victim operating system disguised as a legitimate software update from the software vendor.
Terminology & mappings
Mapped taxonomies
- ATTACK: Masquerading: Invalid Code Signature (1036.001)
- ATTACK: Subvert Trust Controls: Code Signing (1553.002)
Frequently asked questions
Common questions about CAPEC-473.
- What is CAPEC-473?
- An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
- What weaknesses does CAPEC-473 target?
- CAPEC-473 exploits 3 CWE weaknesses, including CWE-20 (Improper Input Validation), CWE-290 (Authentication Bypass by Spoofing), CWE-327 (Use of a Broken or Risky Cryptographic Algorithm).
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-473
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.