Home > CAPEC List > CAPEC-94: Adversary in the Middle (AiTM) (Version 3.9)

CAPEC-94: Adversary in the Middle (AiTM)

Attack Pattern ID: 94
Abstraction: Meta
View customized information:
Description

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

Extended Description

Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first flows through the adversary, who has the opportunity to observe or alter it, before being passed on to the intended recipient as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for these attacks yields an implicit lack of trust in communication or identify between two components.

These attacks differ from Sniffing Attacks (CAPEC-157) since these attacks often modify the communications prior to delivering it to the intended recipient.

Alternate Terms

Term: Man-in-the-Middle / MITM

Term: Person-in-the-Middle / PiTM

Term: Monkey-in-the-Middle

Term: Monster-in-the-Middle

Term: On-path Attacker

Likelihood Of Attack

High

Typical Severity

Very High

Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.219XML Routing Detour Attacks
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.384Application API Message Manipulation via Man-in-the-Middle
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.386Application API Navigation Remapping
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.466Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.662Adversary in the Browser (AiTB)
ParentOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.701Browser in the Middle (BiTM)
CanFollowMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.216Communication Channel Manipulation
CanFollowDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.383Harvesting Information via API Event Monitoring
CanFollowStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.697DHCP Spoofing
CanPrecedeMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.151Identity Spoofing
CanPrecedeStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.668Key Negotiation of Bluetooth Attack (KNOB)
CanPrecedeStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.271Schema Poisoning
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
Execution Flow
Explore

  1. Determine Communication Mechanism: The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit.

    Techniques
    Perform a sniffing attack and observe communication to determine a communication protocol.
    Look for application documentation that might describe a communication mechanism used by a target.
Experiment

  1. Position In Between Targets: The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.

    Techniques
    Install spyware on a client that will intercept outgoing packets and route them to their destination as well as route incoming packets back to the client.
    Exploit a weakness in an encrypted communication mechanism to gain access to traffic. Look for outdated mechanisms such as SSL.
Exploit

  1. Use Intercepted Data Maliciously: The adversary observes, filters, or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.

    Techniques
    Prevent some messages from reaching their destination, causing a denial of service.
Prerequisites
There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
An attacker can eavesdrop on the communication between the target components.
Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.
Skills Required
[Level: Medium]
This attack can get sophisticated since the attack may use cryptography.
Consequences
Section HelpThis table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
ScopeImpactLikelihood
Integrity
Modify Data
Confidentiality
Access Control
Authorization
Gain Privileges
Confidentiality
Read Data
Mitigations
Ensure Public Keys are signed by a Certificate Authority
Encrypt communications using cryptography (e.g., SSL/TLS)
Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
Exchange public keys using a secure channel
Example Instances

In 2017, security researcher Jerry Decime discovered that Equifax mobile applications were not leveraging HTTPS in all areas. Although authentication was properly utilizing HTTPS, in addition to validating the root of trust of the server certificate, other areas of the application were using HTTP to communicate. Adversaries could then conduct MITM attacks on rogue WiFi or cellular networks and hijack the UX. This further allowed the adversaries to prompt users for sensitive data, which could then be obtained in the plaintext response. [REF-636]

Taxonomy Mappings
Section HelpCAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.
Relevant to the ATT&CK taxonomy mapping
Entry IDEntry Name
1557 Adversary-in-the-Middle

Relevant to the OWASP taxonomy mapping
Entry Name
Man-in-the-middle attack
References
[REF-553] M. Bishop. "Computer Security: Art and Science". Addison-Wesley. 2003.
[REF-633] "Man-in-the-middle attack". Open Web Application Security Project (OWASP). <https://owasp.org/www-community/attacks/Man-in-the-middle_attack>. URL validated: 2021年02月10日.
[REF-634] Kyle Chivers. "What is a man-in-the-middle attack?". NortonLifeLock Inc.. 2020年03月26日. <https://us.norton.com/internetsecurity-wifi-what-is-a-man-in-the-middle-attack.html>. URL validated: 2021年02月10日.
[REF-635] "Man in the middle (MITM) attack". Imperva. <https://www.imperva.com/learn/application-security/man-in-the-middle-attack-mitm/>. URL validated: 2021年02月10日.
[REF-636] Jerry Decime. "Settling the score: taking down the Equifax mobile application". 2017年09月13日. <https://www.linkedin.com/pulse/settling-score-taking-down-equifax-mobile-application-jerry-decime/>. URL validated: 2021年02月10日.
Content History
Submissions
Submission DateSubmitterOrganization
2014年06月23日
(Version 2.6)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2017年08月04日
(Version 2.11)
CAPEC Content TeamThe MITRE Corporation
Updated Examples-Instances, Related_Vulnerabilities
2018年07月31日
(Version 2.12)
CAPEC Content TeamThe MITRE Corporation
Updated References
2019年04月04日
(Version 3.1)
CAPEC Content TeamThe MITRE Corporation
Updated Example_Instances, Related_Attack_Patterns, Taxonomy_Mappings
2019年09月30日
(Version 3.2)
CAPEC Content TeamThe MITRE Corporation
Updated @Abstraction, Description, Related_Attack_Patterns
2020年07月30日
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Description, Example_Instances, Execution_Flow, Taxonomy_Mappings
2020年12月17日
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns, Taxonomy_Mappings
2021年06月24日
(Version 3.5)
CAPEC Content TeamThe MITRE Corporation
Updated @Name, @Status, Alternate_Terms, Description, Example_Instances, Execution_Flow, Mitigations, References, Related_Attack_Patterns, Related_Weaknesses, Taxonomy_Mappings
2022年02月22日
(Version 3.7)
CAPEC Content TeamThe MITRE Corporation
Updated Description, Execution_Flow, Extended_Description
2022年09月29日
(Version 3.8)
CAPEC Content TeamThe MITRE Corporation
Updated Taxonomy_Mappings
Previous Entry Names
Change DatePrevious Entry Name
2021年06月24日
(Version 3.5)
Man in the Middle Attack
More information is available — Please select a different filter.
Page Last Updated or Reviewed: June 24, 2021

Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.

AltStyle によって変換されたページ (->オリジナル) /