ISOL 536 Security Architecture and Design Threat Modeling Session 3 “What Can Go Wrong?”
Agenda
• STRIDE (in depth!)
• Reading: Chapter 3
Approach
• “What can go wrong” & “what to do about it” are often (and reasonably) tied together in practice • This course splits them because they are distinct questions & skills
Security mavens Experts in other areas
STRIDE Trees Libraries
STRIDE
STRIDE Agenda
• Recap: A mnemonic for finding threats • Details as examples • Variants
STRIDE (review)
Threat Property Violated
Definition Example
Spoofing Authentication Impersonating something or someone else.
Pretending to be any of Bill Gates, Paypal.com or ntdll.dll
Tampering Integrity Modifying data or code Modifying a DLL on disk or DVD, or a packet as it traverses the network Repudiation Non-repudiation Claiming to have not performed an action. “I didn’t send that email,” “I didn’t modify that file,” “I certainly didn’t visit that web site, dear!”
Information Disclosure
Confidentiality Exposing information to someone not authorized to see it
Allowing someone to read the Windows source code; publishing a list of customers to a web site.
Denial of Service Availability Deny or degrade service to users
Crashing Windows or a web site, sending a packet and absorbing seconds of CPU time, or routing packets into a black hole.
Elevation of Privilege Authorization Gain capabilities without proper authorization
Allowing a remote Internet user to run commands is the classic example, but going from a limited user to admin is also EoP.
Spoofing
By Lego Envy, http://www.eurobricks.com/forum/index.php?showtopic=64532
Spoofing On the Local Machine
Threat Example What the Attacker Does Notes/Examples
Spoofing a process Creates a file before the real process
Then your process relies on it Abuses names Create a version of “sudo” and alter PATH Spoofing a filename Creates a file in the local directory Library, executable or config file Creates a link, changes it Also called ‘race condition’ or TOCTOU Creates many files in a target directory Code can easily create all possible /tmp/foo.random
Spoofing Over a Network
Threat Example What the Attacker Does Notes/Examples
Spoofing a machine ARP spoofing IP spoofing DNS spoofing DNS compromise Can be at the TLD, registrar or DNS server
IP redirection Spoofing a person Take over account “Stranded in London” Set the display name Spoofing a role Declares themselves to be that role Sometimes opening a special account, setting up a domain/website, other “verifiers”
Tampering
http://pinlac.com/LegoDSTractorBeam.html
Tampering with a File
Threat Example What the Attacker Does Notes/Examples
Modifying a file… … which you own and you rely on … which they own and you rely on Modifying a file on a server… …you own …they own (or take over)
Modifies links or redirects Redirects are supercommon on the web, and often rot away
Tampering with Memory
Threat Example What the Attacker Does Notes/Examples
Modifying code Changes your code to suit themselves
Hard to defend against if the attacker is running code inside the trust boundaries
Modifying data they’ve supplied
Supplies data to a pass by reference API, then changes it
Works because of TOCTOU issues
Supplies data into a shared memory segment, then changes it
Tampering with a Network
Threat Example What the Attacker Does Notes/Examples
Redirects the flow of data to their machine
Uses an attack at some network layer to redirect traffic
Pakistan/YouTube
Modifies data flowing over the network
Easier (and more fun) with wireless networks
Uses network tampering to improve spoofing attacks
Repudiation Repudiation
By Seb H http://www.flickr.com/photos/88048956@N04/8531040850/
Repudiation
Threat Example What the Attacker Does Notes/examples
Repudiating an action Claims to have not clicked
Maybe they did, maybe they didn’t, maybe they’re honestly confused
Claims to not have received
1. Electronic or physical 2. Receipt is strange; does a client downloading email mean you’ve seen it? Did a network proxy prefetch images? Was a package left on a porch?
Claims to be a fraud victim Uses someone else’s account
Repudiation Attacks on Logs
Threat Example What the Attacker Does Notes/Examples
Discovers there are no logs
Modifies data flowing over the network
Puts data in the logs to confuse you