Detail CAPEC-481

CAPEC-481

Contradictory Destinations in Traffic Routing Schemes
2019-04-04
00h00 +00:00
Sedang
Tinggi
Draft
2023-01-24
00h00 +00:00
CAPEC Mitre.org
Peringatan untuk CAPEC tertentu
Tetap terinformasi tentang perubahan untuk CAPEC tertentu.
Kelola notifikasi

Deskripsi CAPEC

Adversaries can provide contradictory destinations when sending messages. Traffic is routed in networks using the domain names in various headers available at different levels of the OSI model. In a Content Delivery Network (CDN) multiple domains might be available, and if there are contradictory domain names provided it is possible to route traffic to an inappropriate destination. The technique, called Domain Fronting, involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. An alternative technique, called Domainless Fronting, is similar, but the SNI field is left blank.

Informasi CAPEC

Prasyarat

An adversary must be aware that their message will be routed using a CDN, and that both of the contradictory domains are served from that CDN.
If the purpose of the Domain Fronting is to hide redirected C2 traffic, the C2 server must have been created in the CDN.

Keahlian yang Diperlukan

The adversary must have some knowledge of how messages are routed.

Mitigasi

Monitor connections, checking headers in traffic for contradictory domain names, or empty domain names.

Kelemahan Terkait

CWE-ID Nama Kelemahan

CWE-923

 Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis
CAPEC Content Team The MITRE Corporation 2019-04-04 +00:00

Modifikasi

Nama Organisasi Tanggal Komentar
CAPEC Content Team The MITRE Corporation 2019-09-30 +00:00 Updated @Abstraction
CAPEC Content Team The MITRE Corporation 2020-07-30 +00:00 Updated Related_Attack_Patterns, Taxonomy_Mappings
CAPEC Content Team The MITRE Corporation 2023-01-24 +00:00 Updated Related_Weaknesses
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.