Dark Mode

Settings

Capec-191 Detail

Read Sensitive Constants Within an Executable

Detailed Software Physical Security Typical Severity: Low

Parents: 167

Threats: T60

Description

An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.

Extended Description

One specific example of a sensitive string is a hard-coded password. Typical examples of software with hard-coded passwords include server-side executables which may check for a hard-coded password or key during a user's authentication with the server. Hard-coded passwords can also be present in client-side executables which utilize the password or key when connecting to either a remote component, such as a database server, licensing server, or otherwise, or a processes on the same host that expects a key or password. When analyzing an executable the adversary may search for the presence of such strings by analyzing the byte-code of the file itself. Example utilities for revealing strings within a file include 'strings,' 'grep,' or other variants of these programs depending upon the type of operating system used. These programs can be used to dump any ASCII or UNICODE strings contained within a program. Strings can also be searched for using a hex editors by loading the binary or object code file and utilizing native search functions such as regular expressions. Additionally, sensitive numeric values can occur within an executable. This can be used to discover the location of cryptographic constants.
External ID Source Link Description
CAPEC-191 capec https://capec.mitre.org/data/definitions/191.html
CWE-798 cwe http://cwe.mitre.org/data/definitions/798.html
T1552.001 ATTACK https://attack.mitre.org/wiki/Technique/T1552/001 Unsecured Credentials:Credentials in files
REF-51 reference_from_CAPEC http://en.wikipedia.org/wiki/Decompiler Wikipedia, The Wikimedia Foundation, Inc
REF-52 reference_from_CAPEC http://en.wikipedia.org/wiki/Debugger Wikipedia, The Wikimedia Foundation, Inc
REF-53 reference_from_CAPEC http://en.wikipedia.org/wiki/Disassembler Wikipedia, The Wikimedia Foundation, Inc

Not present

  1. Access to a binary or executable such that it can be analyzed by various utilities.
  1. Binary analysis programs such as 'strings' or 'grep', or hex editors.

Not present

Not present

Not present