CAPEC Definitions

    CAPEC Definitions / CAPEC-94

    CAPEC-94: Adversary in the Middle (AiTM)

    An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

    Severity:Very High
    Possibility:High

    Extended Description

    Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first flows through the adversary, who has the opportunity to observe or alter it, before being passed on to the intended recipient as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for these attacks yields an implicit lack of trust in communication or identify between two components. These attacks differ from Sniffing Attacks (CAPEC-157) since these attacks often modify the communications prior to delivering it to the intended recipient.

    Mitigations

    Ensure Public Keys are signed by a Certificate Authority

    Encrypt communications using cryptography (e.g., SSL/TLS)

    Use Strong mutual authentication to always fully authenticate both ends of any communications channel.

    Exchange public keys using a secure channel

    Relationships with other CAPECs

    CAPEC-151: Identity Spoofing

    CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)

    Prerequisites

    There are two components communicating with each other.

    An attacker is able to identify the nature and mechanism of communication between the two target components.

    An attacker can eavesdrop on the communication between the target components.

    Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.

    The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

    Related Weaknesses

    CWE-300: Channel Accessible by Non-Endpoint

    CWE-290: Authentication Bypass by Spoofing

    CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

    CWE-287: Improper Authentication

    CWE-294: Authentication Bypass by Capture-replay