Malleability attacks against encryption without authentication Suppose there is a message that is encrypted with AES-128-CBC.  The message is as follows, new lines are used to delimit the 16 byte boundary for each block:

Wire funds from:
Alice to Bob in 
 the amount of $
1


Because this message is encrypted using CBC mode,  any modification of the first block of cipher text would propagate throughout the message.   However, the amount of the fund transfer falls in the last block.  I am under the assumption that an attacker can use the property of Malleability to alter the last block and produce a valid amount that is greater than \$1 in far fewer than $2^{128}$ operations. 

Is this a correct assumption?  Is there a name for this attack or do you know of a real world example?  

My instinct is that if you just need one byte of the 16 byte block to be of a specific value then it would only require $2^8$ operations because the other 120 bits of the plain text could be any value. For example lets say we wanted the last block of cipher text to decrypt to 9\0 (where \0 denotes a single null byte, and the message would be interpreted as \$9), then it would take only $2^{16}$ operations to find this cipher text block.

Is there something I am missing?
First of all, you stated:


  Because this message is encrypted using CBC mode, any modification of
  the first block of cipher text would propagate throughout the message.


Actually, that's not true.  Here's the CBC mode operation in the decryption direction:



(Public domain image from Wikimedia Commons.)

If you examine the process closely, you will see that a specific plaintext block depends only on two ciphertext blocks (or a ciphertext block and the IV for the very first plaintext block).

So, if you modify a ciphertext block $N$ (say, flip one of the bits), then the resulting plaintext will have block $N$ garbled (because the modified block goes through the decryption, and unless we picked a ciphertext block which we already knew the decryption of, the result will be unpredictable).  In addition, block $N+1$ will have the corresponding bits modified (in our example, the same bit will be flipped).  And, there will be no other changes; all other plaintext blocks will be exactly what they were in the original message.

So, how can we use this observation?  Well, if block $N$ is the one we want to affect, and we don't mind if block $N-1$ decrypts to something unpredictable, the obvious approach is to modify block $N-1$ of the ciphertext.  If we guess that the real plaintext is $A$ (which corresponds to \$1), and we want it to read $B$ (which corresponds to (\$1000000), then we exclusive or $A \oplus B$ into ciphertext block $N-1$; this will cause the last ciphertext block to read exactly as we want it to.