2. of Spoofing

An attacker could squat on the random port or socket that the server normally uses.

Or the alternative text:

An attacker could take over the port or socket that the server normally uses.

Threat
	Also known as scheme squatting. An attacker could bind to port 80, the port used for the HyperText Transfer Protocol (HTTP), and respond to requests instead of your app/service. If an attacker responds to your service calls instead of the service, they can feed your consumer fake data.
CAPEC [1]	CAPEC-616 - Establish Rogue Location CAPEC-505 - Scheme Squatting
ASVS [2]	N/A
CWE [3]	CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Mitigations

Use Transport Layer Security (TLS) for your service so that its client can verify the authenticity of the application. Ensure certificates are signed by a trusted Certificate Authority (CA). Ensure that certificates have not expired or been revoked. Enable Multi-Factor Authentication (MFA). Use reserved ports. Restrict who can install applications. Use an alert for configuration changes such as Config in AWS. Overwrite configuration regularly using Puppet to ensure constancy.