CAPEC-700: Network Boundary Bridging
An adversary which has gained elevated access to network boundary devices may use these devices to create a channel to bridge trusted and untrusted networks. Boundary devices do not necessarily have to be on the network’s edge, but rather must serve to segment portions of the target network the adversary wishes to cross into.
Last updated
Overview
Network boundary devices are network devices such as routers and firewalls which segment networks by restricting certain types of traffic from flowing through the device. Network boundary devices are often directly accessible through a portal page for management purposes. An adversary’s goal when conducting network boundary bridging is to connect networks which are being segmented by the device. To do so, the adversary must first compromise the network boundary device.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Identify potential targets] An adversary identifies network boundary devices that can be compromised.
- The adversary traces network traffic to identify which devices the traffic flows through. Additionally, the adversary can identify devices using fingerprinting methods or locating the management page to determine identifying information about the device.
- Step 2Experiment
[Compromise targets] The adversary must compromise the identified targets in the previous step.
- Once the device is identified, the adversary can attempt to input known default credentials for the device to gain access to the management console.
- Adversaries with sufficient identifying knowledge about the target device can exploit known vulnerabilities in network devices to obtain administrative access.