CAPEC-217 Exploiting Incorrectly Configured SSL/TLS

CAPEC ID: 217

CAPEC-217 Metadata

Likelihood of Attack

Low

Typical Severity

Low

Overview

Summary

An adversary takes advantage of incorrectly configured SSL/TLS communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.

Prerequisites

Access to the client/server stream.

Execution Flow

Step Phase Description Techniques
1 Explore [Determine SSL/TLS Configuration] Determine the SSL/TLS configuration of either the server or client being targeted, preferably both. This is not a hard requirement, as the adversary can simply assume commonly exploitable configuration settings and indiscriminately attempt them.
  • If the target is a webpage, some of the SSL/TLS configuration can be viewed through the browser's security information, such as the key sizes and cipher being used.
2 Experiment [Intercept Communication] Provide controlled access to the server by the client, by either providing a link for the client to click on, or by positioning one's self at a place on the network to intercept and control the flow of data between client and server, e.g. AiTM (adversary in the middle - CAPEC-94).
  • Create a malicious webpage that looks identical to the target webpage, but routes client traffic to the server such that the adversary can observe the traffic and perform an adverary in the middle attack.
  • If the adversary has access to the network that either the client or server is on, the can attempt to use a packet sniffer to perform an adversary in the middle attack.
  • Install a packet sniffer through malware directly to a client device that can intercept SSL/TLS traffic and perform an adversary in the middle attack.
3 Exploit [Capture or Manipulate Sensitive Data] Once the adversary has the ability to intercept the secure communication, they exploit the incorrectly configured SSL to view the encrypted communication. The adversary can choose to just record the secure communication or manipulate the data to achieve a desired effect.
  • Use known exploits for old SSL and TLS versions.
  • Use known exploits for weak ciphers such as DES and RC4.

Potential Solutions / Mitigations

Do not use SSL, as all SSL versions have been broken and should not be used. If TLS is not an option for the client or server, consider setting timeouts on SSL sessions to extremely low values to lessen the potential impact. Only use TLS version 1.2+, as versions 1.0 and 1.1 are insecure. Configure TLS to use secure algorithms. The current recommendation is to use ECDH, ECDSA, AES256-GCM, and SHA384 for the most security.

Related Weaknesses (CWE)

CWE ID Description
CWE-201 Insertion of Sensitive Information Into Sent Data

Related CAPECs

CAPEC ID Description
CAPEC-216 An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

Stay Ahead of Attack Patterns

Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.