CAPEC Details
Name Retrieve Embedded Sensitive Data
Likelyhood of attack Typical severity
High Very High
Summary An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.
Prerequisites In order to feasibly execute this type of attack, some valuable data must be present in client software. Additionally, this information must be unprotected, or protected in a flawed fashion, or through a mechanism that fails to resist reverse engineering, statistical, or other attack.
Execution Flow
Step Phase Description Techniques
1 Explore [Identify Target] Attacker identifies client components to extract information from. These may be binary executables, class files, shared libraries (e.g., DLLs), configuration files, or other system files.
  • Binary file extraction. The attacker extracts binary files from zips, jars, wars, PDFs or other composite formats.
  • Package listing. The attacker uses a package manifest provided with the software installer, or the filesystem itself, to identify component files suitable for attack.
2 Exploit [Retrieve Embedded Data] The attacker then uses a variety of techniques, such as sniffing, reverse-engineering, and cryptanalysis to retrieve the information of interest.
  • API Profiling. The attacker monitors the software's use of registry keys or other operating system-provided storage locations that can contain sensitive information.
  • Execution in simulator. The attacker physically removes mass storage from the system and explores it using a simulator, external system, or other debugging harness.
  • Common decoding methods. The attacker applies methods to decode such encodings and compressions as Base64, unzip, unrar, RLE decoding, gzip decompression and so on.
  • Common data typing. The attacker looks for common file signatures for well-known file types (JPEG, TIFF, ASN.1, LDIF, etc.). If the signatures match, they attempt decoding in that format.
Solutions
Related Weaknesses
CWE ID Description
CWE-226 Sensitive Information in Resource Not Removed Before Reuse
CWE-311 Missing Encryption of Sensitive Data
CWE-312 Cleartext Storage of Sensitive Information
CWE-314 Cleartext Storage in the Registry
CWE-315 Cleartext Storage of Sensitive Information in a Cookie
CWE-318 Cleartext Storage of Sensitive Information in Executable
CWE-525 Use of Web Browser Cache Containing Sensitive Information
CWE-1239 Improper Zeroization of Hardware Register
CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information
CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device
CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition
CWE-1278 Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component
CWE-1330 Remanent Data Readable after Memory Erase
Related CAPECS
CAPEC ID Description
CAPEC-167 An attacker discovers the structure, function, and composition of a type of computer software through white box analysis techniques. White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revealing at least a portion of its machine instructions that can be observed upon execution.
Taxonomy: ATTACK
Entry ID Entry Name
1005 Data from Local System
1552.004 Unsecured Credentials: Private Keys