aol.pm

Replication Through Removable Media

Technique · ATTACK:mobile:T1458

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1458",
  "title": "Replication Through Removable Media",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1458",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--667e5707-3843-4da8-bd34-88b922526f0d",
  "external_id": "T1458",
  "domain": "mobile",
  "created": "2017-10-25T14:48:23.233Z",
  "modified": "2024-11-17T13:26:29.167Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "initial-access",
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Krebs-JuiceJacking",
      "url": "http://krebsonsecurity.com/2011/08/beware-of-juice-jacking/"
    },
    {
      "source_name": "GoogleProjectZero-OATmeal",
      "url": "https://googleprojectzero.blogspot.com/2018/09/oatmeal-on-universal-cereal-bus.html"
    },
    {
      "source_name": "Lau-Mactans",
      "url": "https://media.blackhat.com/us-13/US-13-Lau-Mactans-Injecting-Malware-into-iOS-Devices-via-Malicious-Chargers-WP.pdf"
    },
    {
      "source_name": "Computerworld-iPhoneCracking",
      "url": "https://www.techcentral.ie/two-vendors-now-sell-iphone-cracking-technology-police-buying/"
    },
    {
      "source_name": "IBM-NexusUSB",
      "url": "https://securityintelligence.com/android-vulnerabilities-attacking-nexus-6-and-6p-custom-boot-modes/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/physical-threats/PHY-1.html",
      "external_id": "PHY-1"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/physical-threats/PHY-2.html",
      "external_id": "PHY-2"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-6.html",
      "external_id": "STA-6"
    }
  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0312 → uses → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0791f28b-d06f-4fee-9cdb-85a6fd2eed61

PaloAlto-WireLurker

ATTACK:mobile:M1003 → mitigates → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3230c032-17e0-49f7-b948-c157049aafe2

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abd2e863-4bd3-4686-b2aa-f8a097a41c99

Elcomsoft-iOSRestricted

ATTACK:mobile:S0315 → uses → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7282bf9-63f8-49ad-8ee0-f2ad523a367e

PaloAlto-DualToy

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c021d9b9-3850-425d-b3d2-6b7bd7e62b95

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb6dbe2a-6f76-4bce-ab37-66ec67148041

ATTACK:mobile:M1001 → mitigates → ATTACK:mobile:T1458

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f95fec2e-f5cf-49c9-8e0b-1c6c5fd15d8f

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.