CAPEC-5: Blue Boxing | RadicalNotion.AI

Overview

CAPEC-5 (Blue Boxing) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

System must use weak authentication mechanisms for administrative functions.

Skills required

Low skill: Given a vulnerable phone system, the attackers' technical vector relies on attacks that are well documented in cracker 'zines and have been around for decades.

Resources required

CCITT-5 or other vulnerable lines, with the ability to send tones such as combined 2,400 Hz and 2,600 Hz tones to the switch

Consequences

What a successful CAPEC-5 attack can achieve.

Resource Consumption

Affects: Availability

Denial of Service

Gain Privileges

Affects: Confidentiality, Access Control, Authorization

How to mitigate it

Defenses that reduce the risk of CAPEC-5.

Implementation: Upgrade phone lines. Note this may be prohibitively expensive
Use strong access control such as two factor access control for administrative access to the switch

Examples

An adversary identifies a vulnerable CCITT-5 phone line, and sends a combination tone to the switch in order to request administrative access. Based on tone and timing parameters the request is verified for access to the switch. Once the adversary has gained control of the switch launching calls, routing calls, and a whole host of opportunities are available.

The CWE weaknesses that CAPEC-5 exploits.

CWE-285: Improper Authorization

How this attack relates to others in the CAPEC hierarchy.

Parent

CAPEC-220: Client-Server Protocol Manipulation

Frequently asked questions

Common questions about CAPEC-5.

What is CAPEC-5?

This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions. This attack pattern is included in CAPEC for historical purposes.

How do you prevent CAPEC-5?

Implementation: Upgrade phone lines. Note this may be prohibitively expensive

What weaknesses does CAPEC-5 target?

CAPEC-5 exploits 1 CWE weakness, including CWE-285 (Improper Authorization).

How severe is CAPEC-5?

MITRE rates CAPEC-5 as Very High severity with medium likelihood of attack.

References

MITRE CAPEC definition (CAPEC-5) (opens in a new tab)

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.