CAPEC™ 156: Engage in Deceptive Interactions
Description
Attack patterns within this category focus on malicious interactions with a target in an attempt to deceive the target and convince the target that it is interacting with some other principal and as such take actions based on the level of trust that exists between the target and the other principal. These types of attacks assume that some piece of content or functionality is associated with an identity and that the content / functionality is trusted by the target because of this association. Often identified by the term "spoofing", these types of attacks rely on the falsification of the content and/or identity in such a way that the target will incorrectly trust the legitimacy of the content. For example, an attacker may modify a financial transaction between two parties so that the participants remain unchanged but the amount of the transaction is increased. If the recipient cannot detect the change, they may incorrectly assume the modified message originated with the original sender. Attacks of these type may involve an adversary crafting the content from scratch or capturing and modifying legitimate content.
Source: CAPEC™ 156
Related ASVS Requirements
ASVS (5.0): 16.3.1, 16.3.2, 16.3.3, 16.3.4, 6.3.5, 6.3.7, 8.1.3, 8.1.4, 8.3.1, 8.3.2, 8.3.3, 8.4.2
