T1600 Weaken Encryption

High-Level Description

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.

Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Network Devices

What to Check

• ] Identify if Weaken Encryption technique is applicable to target environment
• ] Check Network Devices systems for indicators of Weaken Encryption
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Weaken Encryption by examining the target platforms (Network Devices).

1. Assess Existing Defenses: Review whether mitigations for T1600 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Detection Strategy for Weaken Encryption on Network Devices

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------- | -------- | --------------- | | Weaken Encryption technique applicable | High | Defense Evasion |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure |

References

• Cisco Synful Knock Evolution
• Cisco Blog Legacy Device Attacks
• Atomic Red Team - T1600
• MITRE ATT&CK - T1600