Détail du CAPEC-654

An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.

Flux d'exécution

[Determine suitable tasks to exploit] Determine what tasks exist on the target system that may result in a user providing their credentials.

• Determine what tasks prompt a user for their credentials.

[Impersonate Task] Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials.

• Prompt a user for their credentials, while making the user believe the credential request is legitimate.

Conditions préalables

The adversary must already have access to the target system via some means.
A legitimate task must exist that an adversary can impersonate to glean credentials.

Compétences requises

Once an adversary has gained access to the target system, impersonating a credential prompt is not difficult.

Ressources nécessaires

Malware or some other means to initially comprise the target system.
Additional malware to impersonate a legitimate credential prompt.

Atténuations

The only known mitigation to this attack is to avoid installing the malicious application on the device. However, to impersonate a running task the malicious application does need the GET_TASKS permission to be able to query the task list, and being suspicious of applications with that permission can help.

Faiblesses connexes

Soumission

Modifications