T1664_exploitation-for-initial-access

T1664 Exploitation for Initial Access

High-Level Description

Adversaries may exploit software vulnerabilities to gain initial access to a mobile device.

This can be accomplished in a variety of ways. Vulnerabilities may be present in the applications, the services, the underlying operating system, or the kernel itself. Several well-known mobile device exploits exist, including FORCEDENTRY, StageFright, and BlueBorne. Furthermore, some exploits may be possible to exploit without any user interaction (i.e. zero-click exploits, see Exploitation for Client Execution), making them particularly dangerous. Mobile operating system vendors are typically very quick to patch such critical bugs, ensuring only a small window where they can be exploited.

Kill Chain Phase

• Initial Access (TA0027)

Platforms: Android, iOS

What to Check

• Identify if Exploitation for Initial Access technique is applicable to target mobile environment
• Check Android devices for indicators of Exploitation for Initial Access
• Check iOS devices for indicators of Exploitation for Initial Access
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Exploitation for Initial Access by examining the target platforms (Android, iOS).

Assess Existing Defenses

Review whether mitigations for T1664 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

M1001 Security Updates

Security updates frequently contain patches for known software vulnerabilities.

M1058 Antivirus/Antimalware

Mobile security products can potentially detect if a device is vulnerable to a known exploit and can alert the user to update their device.

Detection

Detection of Exploitation for Initial Access

Risk Assessment

CWE Categories

References

• MITRE ATT&CK Mobile - T1664