CAPEC-65: Sniff Application Code
An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.
Last updated
Overview
CAPEC-65 (Sniff Application Code) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Set up a sniffer] The adversary sets up a sniffer in the path between the server and the client and watches the traffic.
- The adversary sets up a sniffer in the path between the server and the client.
- Step 2Exploit
[Capturing Application Code Bound During Patching]adversary knows that the computer/OS/application can request new applications to install, or it periodically checks for an available update. The adversary loads the sniffer set up during Explore phase, and extracts the application code from subsequent communication. The adversary then proceeds to reverse engineer the captured code.
- adversary loads the sniffer to capture the application code bound during a dynamic update.
- The adversary proceeds to reverse engineer the captured code.
What the attacker needs
Prerequisites
- The attacker must have the ability to place themself in the communication path between the client and server.
- The targeted application must receive some application code from the server; for example, dynamic updates, patches, applets or scripts.
- The attacker must be able to employ a sniffer on the network without being detected.
Skills required
- Medium skill: The attacker needs to setup a sniffer for a sufficient period of time so as to capture meaningful quantities of code. The presence of the sniffer should not be detected on the network. Also if the attacker plans to employ an adversary-in-the-middle attack (CAPEC-94), the client or server must not realize this. Finally, the attacker needs to regenerate source code from binary code if the need be.
Resources required
- The Attacker needs the ability to capture communications between the client being updated and the server providing the update. In the case that encryption obscures client/server communication the attacker will either need to lift key material from the client.
Consequences
What a successful CAPEC-65 attack can achieve.
Read Data
Affects: Confidentiality
Gain Privileges
Affects: Confidentiality, Access Control, Authorization
How to mitigate it
Defenses that reduce the risk of CAPEC-65.
- Design: Encrypt all communication between the client and server.
- Implementation: Use SSL, SSH, SCP.
- Operation: Use "ifconfig/ipconfig" or other tools to detect the sniffer installed in the network.
Examples
Attacker receives notification that the computer/OS/application has an available update, loads a network sniffing tool, and extracts update data from subsequent communication. The attacker then proceeds to reverse engineer the captured stream to gain sensitive information, such as encryption keys, validation algorithms, applications patches, etc..
Plain code, such as applets or JavaScript, is also part of the executing application. If such code is transmitted unprotected, the attacker can capture the code and possibly reverse engineer it to gain sensitive information, such as encryption keys, validation algorithms and such.
Terminology & mappings
Mapped taxonomies
- ATTACK: Network Sniffing (1040)
Frequently asked questions
Common questions about CAPEC-65.
- What is CAPEC-65?
- An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.
- How does a Sniff Application Code attack work?
- It typically unfolds over 2 phases. It begins with: [Set up a sniffer] The adversary sets up a sniffer in the path between the server and the client and watches the traffic.
- How do you prevent CAPEC-65?
- Design: Encrypt all communication between the client and server.
- What weaknesses does CAPEC-65 target?
- CAPEC-65 exploits 4 CWE weaknesses, including CWE-311 (Missing Encryption of Sensitive Data), CWE-318 (Cleartext Storage of Sensitive Information in Executable), CWE-319 (Cleartext Transmission of Sensitive Information), CWE-693 (Protection Mechanism Failure).
- How severe is CAPEC-65?
- MITRE rates CAPEC-65 as High severity with low likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-65
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.