Weaken Encryption
Description
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts. (Citation: Cisco Blog Legacy Device Attacks)
Mapped SPARTA techniques
2 techniques
T1600 'Weaken Encryption' is the ATT&CK defense-evasion technique for tampering with cryptographic mechanisms to reduce protection; SPARTA DE-0003.07 modifies cryptographic modes for evasion (forcing clear-mode, downgrading algorithms, disabling MAC verification). Tactic and activity align directly.
T1600 'Weaken Encryption' addresses adversary actions that disable, bypass, or weaken cryptographic protections; SPARTA EX-0006 'Disable/Bypass Encryption' is the same activity in the spacecraft TT&C/payload context. Cross-tactic moderate because T1600 sits in defense-evasion while SPARTA EX-0006 is execution.
Cite as SafeMode Space, mitre-attack-enterprise T1600.