CAPEC-536 Metadata
Likelihood of Attack
Low
Typical Severity
High
Overview
Summary
An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.
Prerequisites
The attacker must have previously compromised the victim's systems or have physical access to the victim's systems. Advanced knowledge of software and hardware capabilities of a manufacturer's product.
Execution Flow
| Step | Phase | Description | Techniques |
|---|---|---|---|
| 1 | Explore | [Determine configuration process] The adversary, through a previously compromised system, either remotely or physically, determines what the configuration process is. They look at configuration files, data files, and running processes on the system to identify areas where they could inject malicious data. |
|
| 2 | Explore | [Determine when configuration occurs] The adversary needs to then determine when configuration or recalibration of a system occurs so they know when to inject malicious data. |
|
| 3 | Experiment | [Determine malicious data to inject] By looking at the configuration process, the adversary needs to determine what malicious data they want to insert and where to insert it. |
|
| 4 | Exploit | [Inject malicious data] Right before, or during system configuration, the adversary injects the malicious data. This leads to the system behaving in a way that is beneficial to the adversary and is often followed by other attacks. |
|
Potential Solutions / Mitigations
Ensure that proper access control is implemented on all systems to prevent unauthorized access to system files and processes.
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-284 | Improper Access Control |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-176 | An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.