785
CAPEC-ID Attack Pattern Name
117 Interception
383 Harvesting Information via API Event Monitoring
477 Signature Spoofing by Mixing Signed and Unsigned Content
References
[REF-271]OWASP. "Top 10 2007-Insecure Communications". 2007. < http://www.owasp.org/
index.php/Top_10_2007-A9 >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-172]Chris Wysopal. "Mobile App Top 10 List". 2010 December 3. < https://
www.veracode.com/blog/2010/12/mobile-app-top-10-list >.2023-04-07.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1307]Center for Internet Security. "CIS Microsoft Azure Foundations Benchmark version
1.5.0". 2022 August 6. < https://www.cisecurity.org/benchmark/azure >.2023-01-19.
[REF-1309]Microsoft. "Require secure transfer to ensure secure connections". 2022 July 4.
< https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
>.2023-01-24.
CWE-321: Use of Hard-coded Cryptographic Key
Weakness ID : 321
Structure : Simple
Abstraction : Variant
Description
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted
data may be recovered.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
PeerOf 259 Use of Hard-coded Password 623
PeerOf 1291 Public Key Re-Use for Signing both Debug and Production
Code