Integrity is the part of security people forget until a number is wrong. MITRE T1565.002, Transmitted Data Manipulation, covers adversaries who alter data en route to storage or to other systems. It sits under the impact tactic and applies to Linux, macOS and Windows.
How attackers use it
The goal is to influence outside outcomes or hide activity by changing what a business process, a person or a system receives. MITRE says manipulation may happen over a network connection or between processes on a system, wherever an adversary can place a tool that intercepts and changes information. The effect depends on the target mechanism, and MITRE notes the adversary usually needs special expertise and prior information gathering for complex systems.
How to detect it
MITRE's detection ideas are integrity-focused:
- Mismatched file hashes when you compare origin and destination.
- Anomalies in transmitted data streams, API interception or man-in-the-middle modification.
- Odd activity from processes that talk to secure transmission services such as OpenSSL or scp, and, on macOS, SSL/TLS downgrade attempts.
Hash comparison is the simplest habit. Publish a checksum with transfers that matter and verify it on arrival.
How to reduce the risk
MITRE lists one mitigation: encrypt all important data flows to reduce the impact of tailored modifications in transit. Add integrity checks on important transfers so a change is noticed instead of trusted.
Quick check
What is the simplest way to notice data changed in transit?
Compare file hashes at the origin and the destination. A mismatch means the content changed on the way.
