Chi tiết CAPEC-654

An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.

Luồng thực thi

[Determine suitable tasks to exploit] Determine what tasks exist on the target system that may result in a user providing their credentials.

• Determine what tasks prompt a user for their credentials.

[Impersonate Task] Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials.

• Prompt a user for their credentials, while making the user believe the credential request is legitimate.

Điều kiện tiên quyết

The adversary must already have access to the target system via some means.
A legitimate task must exist that an adversary can impersonate to glean credentials.

Kỹ năng cần thiết

Once an adversary has gained access to the target system, impersonating a credential prompt is not difficult.

Tài nguyên cần thiết

Malware or some other means to initially comprise the target system.
Additional malware to impersonate a legitimate credential prompt.

Các biện pháp giảm thiểu

The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.

Điểm yếu liên quan

Gửi

Sửa đổi