Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1200 | Hardware Additions |
Comments
Adversaries may introduce unauthorized devices onto the network. ATT&CK recommends network access controls such as 802.1X, device certificates, and restricting DHCP to registered devices; these are architectural admission-control mechanisms that directly prevent unauthorized hardware from communicating with trusted systems.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1200 | Hardware Additions |
Comments
Adversaries can attach rogue computers, appliances, or networking hardware to obtain enterprise network connectivity. Secure network management protocols like 802.1X requires successful user or device authentication before network admission, directly denying unauthorized hardware access.
References
|
| CIS-13.9 | Deploy Port-Level Access Control | mitigates | T1200 | Hardware Additions |
Comments
Port-level access control using 802.1X, device certificates, or similar network access control mechanisms can prevent unauthorized hardware from authenticating to and communicating on trusted enterprise networks.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.vector.Physical access | Physical access or connection (i.e., at keyboard or via cable) | related-to | T1200 | Hardware Additions | |
| Attribute.Integrity.Variety.Hardware tampering | Hardware tampering or physical alteration | related-to | T1200 | Hardware Additions | |
| Value_chain.development.variety.Physical | Development of something physical such as a skimming device | related-to | T1200 | Hardware Additions |