Weaken Encryption (T1600) is listed under the Defense Impairment tactic in MITRE ATT&CK, for the Network Devices platform. The adversary compromises a network device's encryption capability so that traffic which should be protected is not.
Notice the angle. Nobody attacks the math. They change the device that applies it.
How attackers use it
MITRE explains that encryption protects transmitted traffic in two ways, confidentiality (against unauthorized disclosure) and integrity (against unauthorized changes). Ciphers turn plaintext into ciphertext, and longer keys raise the cost of decrypting without the key.
Adversaries can compromise and manipulate the devices that encrypt network traffic. MITRE gives three example behaviors: Modify System Image, Reduce Key Space and Disable Crypto Hardware. Any of them can reduce or remove the device's ability to encrypt securely.
The effect, in MITRE's words, is a greater risk of unauthorized disclosure. It may also help data manipulation, credential access or collection.
The two sub-techniques are:
- Reduce Key Space (T1600.001)
- Disable Crypto Hardware (T1600.002)
How to detect it
MITRE's detection strategy is to watch for unauthorized changes to encryption-related configuration files, firmware or crypto modules on network devices. Suspicious patterns include:
- Changes to cipher suite configuration.
- Unexpected firmware updates that affect crypto libraries.
- Disabled hardware cryptographic accelerators.
- Reduced key length policies.
It adds that correlating configuration changes with anomalies in encrypted traffic, such as weaker ciphers or sudden plaintext transmission, strengthens detection.
In practice that means two kinds of baseline. One is the device configuration, compared on a schedule. The other is the traffic itself, such as which cipher suites and key sizes your VPN tunnels negotiate. A tunnel that used to negotiate a strong suite and now does not is a sign.
How to reduce the risk
MITRE's entry for this technique does not list separate mitigations. The threat comes through other behaviors, so protect the paths MITRE names: control who can change the device and what image it boots. The mitigations listed for Modify System Image (T1601) apply here: multi-factor authentication for administrators, strong password policy, encrypted local credentials, code signing, and boot integrity checks.
Add habits of your own:
- Keep a baseline of crypto settings per device and alert on drift.
- Limit administrative access to a small group on a management network.
- Verify the image on a device against the vendor's published checksum or signature.
Check your own environment
On a Cisco IOS device, view the configured IKE policy and the crypto engine (read-only; confirm syntax for your platform):
show crypto isakmp policy
show crypto engine brief
Compare the output with your approved baseline.
Then review:
- Is there a written baseline of approved ciphers and key lengths?
- Are device configuration changes logged and reviewed?
- Does anyone check negotiated ciphers on real traffic?
Quick check
Which behaviors does MITRE give as ways to weaken device encryption?
Modify System Image, Reduce Key Space and Disable Crypto Hardware.
