Detailed attack pattern
Draft
CAPEC-590: IP Address Blocking
An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.
Last updated
High
Typical severity
Per MITRE
Low
Likelihood of attack
Per MITRE
1
Related weaknesses
CWEs this targets
Detailed
Abstraction
MITRE classification
Overview
CAPEC-590 (IP Address Blocking) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.
Consequences
What a successful CAPEC-590 attack can achieve.
Other
Affects: Availability
Blocking packets intended for a target IP address denies its availability to the user.
How to mitigate it
Defenses that reduce the risk of CAPEC-590.
- Have a large pool of backup IPs built into the application and support proxy capability in the application.
Examples
Consider situations of information censorship for political purposes, where regimes that prevent access to specific web services.