7. of Information Disclosure
An attacker can act as a “man in the middle” because you don’t authenticate endpoints of a network connection.
|
Threat |
|
|
|
Although you are encrypting the channel, you aren’t verifying the hostname against the certificate, you aren’t verifying whether the certificate is self-signed or signed by a known CA, you aren’t verifying whether the certificate has expired, and you aren’t verifying whether the certificate has been revoked. |
|
CAPEC |
CAPEC-616 - Establish Rogue Location CAPEC-543 - Counterfeit Websites CAPEC-459 - Creating a Rogue Certification Authority Certificate CAPEC-479 - Malicious Root Certificate CAPEC-384 - Application API Message Manipulation via Man-in-the-Middle |
|
ASVS |
...|
