CAPEC-548
Contaminate Resource
An adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized. When this happens, the contaminated information system, device, or network must be brought offline to investigate and mitigate the data spill, which denies availability of the system until the investigation is complete.
On this page
Contamination through email is a very common attack vector. Systems with email servers or personal work systems using email are susceptible to this attack simply by receiving an email that contains a classified document or information. A fake classified document could even be used that is mistaken as true classified material. This would still cause the system to be taken offline until the validity of the classified material is confirmed.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-548: Contaminate Resource: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/548.html and https://cve.bz/cve/capec/548?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The adversary needs to have real or fake classified/sensitive information to place on a system
Skills required
- Low skill
Knowledge of classification levels of systems
- High skill
The ability to obtain a classified document or information
- Low skill
The ability to fake a classified document
Consequences
| Impact | Affects | Note |
|---|---|---|
| Resource Consumption | Availability | Denial of Service |
| Read Data | Confidentiality | Victims of the attack can be exposed to classified materials |
Mitigations
Properly safeguard classified/sensitive data. This includes training cleared individuals to ensure they are handling and disposing of this data properly, as well as ensuring systems only handle information of the classification level they are designed for.
Design systems with redundancy in mind. This could mean creating backing servers that could be switched over to in the event that a server has to be taken down for investigation.
Have a planned and efficient response plan to limit the amount of time a system is offline while the contamination is investigated.
Related attack patterns
- Can lead to
- CAPEC-607 Obstruction
Examples
An insider threat was able to obtain a classified document. They have knowledge that a backend server which p…
An insider threat was able to obtain a classified document. They have knowledge that a backend server which provides access to a website also runs a mail server. The adversary creates a throwaway email address and sends the classified document to the mail server. When an administrator checks the mail server they notice that it has processed an email with a classified document and the server has to be taken offline while they investigate the contamination. In the meantime, the website has to be taken down as well and access to the website is denied until the backend can be migrated to another server or the investigation is complete.
MITRE's words, unchanged: CAPEC-548 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.