Discussion Paper (STRIDE Variations)
areddy
Week2.pdf
ISOL536 Security Architecture
and Design Threat Modeling
Week 2
Agenda
• STRIDE (in depth!) • Attack trees • Attack libraries
• Reading: Chapter 3, 4, 5
Approach
• “What can go wrong” & “what to do about it” are often (and reasonably) tied together in practice
• This course splits them because they are distinct questions & skills
Security mavens Experts in other areas
STRIDE Trees Libraries
STRIDE
STRIDE Agenda
• Recap: A mnemonic for finding threats • Details as examples • Variants
STRIDE (review)
Threat Property Violated
Definition Example
Spoofing Authentication Impersonating something or someone
else.
Pretending to be any of Bill Gates, Paypal.com or
ntdll.dll
Tampering Integrity Modifying data or code Modifying a DLL on disk or DVD, or a packet as it traverses the network
Repudiation Non-repudiation Claiming to have not performed an action.
“I didn’t send that email,” “I didn’t modify that
file,” “I certainly didn’t visit that web site, dear!”
Information Disclosure
Confidentiality Exposing information
to someone not
authorized to see it
Allowing someone to read the Windows source
code; publishing a list of customers to a web site.
Denial of Service Availability Deny or degrade service to users
Crashing Windows or a web site, sending a
packet and absorbing seconds of CPU time, or
routing packets into a black hole.
Elevation of Privilege Authorization Gain capabilities without proper
authorization
Allowing a remote Internet user to run
commands is the classic example, but going from
a limited user to admin is also EoP.
Spoofing
By Lego Envy, http://www.eurobricks.com/forum/index.php?showtopic=64532
Spoofing On the Local Machine Threat Example What the Attacker Does Notes/Examples
Spoofing a process Creates a file before the real process
Then your process relies on it
Abuses names Create a version of “sudo” and alter PATH
Spoofing a filename Creates a file in the local directory
Library, executable or config file
Creates a link, changes it Also called ‘race condition’ or TOCTOU
Creates many files in a target directory
Code can easily create all possible /tmp/foo.random
Spoofing Over a Network Threat Example What the Attacker Does Notes/Examples
Spoofing a machine ARP spoofing
IP spoofing
DNS spoofing
DNS compromise Can be at the TLD, registrar or DNS server
IP redirection
Spoofing a person Take over account “Stranded in London”
Set the display name
Spoofing a role Declares themselves to be that role
Sometimes opening a special account, setting up a domain/website, other “verifiers”
Tampering
http://pinlac.com/LegoDSTractorBeam.html
Tampering with a File Threat Example What the Attacker Does Notes/Examples
Modifying a file… … which you own and you rely on
… which they own and you rely on
Modifying a file on a server… …you own
…they own (or take over)
Modifies links or redirects Redirects are super-common on the web, and often rot away
Tampering with Memory Threat Example What the Attacker Does Notes/Examples
Modifying code Changes your code to suit themselves
Hard to defend against if the attacker is running code inside the trust boundaries
Modifying data they’ve supplied
Supplies data to a pass by reference API, then changes it
Works because of TOCTOU issues
Supplies data into a shared memory segment, then changes it
Tampering with a Network Threat Example What the Attacker Does Notes/Examples
Redirects the flow of data to their machine
Uses an attack at some network layer to redirect traffic
Pakistan/YouTube
Modifies data flowing over the network
Easier (and more fun) with wireless networks
Uses network tampering to improve spoofing attacks
Repudiation
Repudiation
By Seb H http://www.flickr.com/photos/88048956@N04/8531040850/
Repudiation Threat Example What the Attacker Does Notes/examples
Repudiating an action Claims to have not clicked Maybe they did, maybe they didn’t, maybe they’re honestly confused
Claims to not have received 1. Electronic or physical 2. Receipt is strange; does a client downloading email mean you’ve seen it? Did a network proxy pre-fetch images? Was a package left on a porch?
Claims to be a fraud victim
Uses someone else’s account
Repudiation Attacks on Logs Threat Example What the Attacker Does Notes/Examples
Discovers there are no logs
Modifies data flowing over the network
Puts data in the logs to confuse you
</tr></html>
Information Disclosure
Information Disclosure (Processes) Threat Example What the Attacker Does Notes/Examples
Extracts user data Exploits bugs like SQL injection to read db tables
Can find this by looking to data stores, but here the issue is the process returning data it shouldn’t
Reads error messages
Extracts machine secrets Reads error messages Cannot connect to database ‘foo’ as user ‘sql’ with password ‘&IO*(^&’
Exploits bugs “Heartbleed”
Information Disclosure (Data Stores)Sub-category What the Attacker Does
Permissions Take advantage of missing or inappropriate ACLs
Take advantage of bad database permissions
File files protected by obscurity
Security Find crypto keys on disk or in memory
Get data from logs/temp files
Get data from swap files
See interesting information in filenames/directory names
Network See data traversing a network
Misc Obtain device, boot in new OS
Information Disclosure (Data Flow) Sub-category What the Attacker Does
Network Read data on a network
Redirects traffics to enable reading data on the network
Metadata Learns secrets by analyzing traffic
Learns who talks to whom by watching the DNS
Learns who talks to whom by analyzing social network information
Denial of Service
Model by Nathan Sawaya http://brickartist.com/gallery/han-solo-in-carbonite/
Denial of Service Threat Example What the Attacker Does Notes/Examples
Against a process Absorb memory (ram or disk)
Absorb CPU
Uses a process as an amplifier
Against business logic “Too many login attempts”
Against a data store Fills the data store
Makes enough requests to slow the system
Against a data flow Consumes network resources
Can be temporary (as the attack continues; fill the network) or persist beyond that (fill a disk)
Elevation of Privilege
http://www.flickr.com/photos/prodiffusion/
Elevation of Privilege (“EoP”) Threat Example What the Attacker Does Notes/Examples
EoP Against process via corruption
Sends inputs the code doesn’t handle properly
Very common, usually high impact
Gains read/write access to memory
Writing memory more obviously bad
EoP via misused authorization checks
EoP via buggy authorization checks
Centralizing checking makes consistency, correctness easier
EoP via data tampering Modify bits on disk
STRIDE Variants
• Ways to focus on likely threats
• STRIDE per element
• STRIDE per interaction
• Elevation of Privilege game
• Training, structure and execution
• DESIST
• Dispute
• Elevation of Privilege
• Spoofing
• Information Disclosure
• Service Denial
• Tampering
Spoofing Tamper. Rep. Info.Disc. DoS EoP
Process
Data Store
Dataflow
External Entity
STRIDE per Element
This is Microsoft’s chart; it may not be the issues you need to worry about (privacy)
Attack Trees • Structured relationship between attack details
• Detail (This is a subcategory of that)
• Present as outline, picture
• Creation vs. use
Using an Attack Tree
• Find an appropriate tree • Web search
• Appendix B of Threat Modeling
• Iterate through your diagram & tree • “Does this apply here?”
• More precise iteration is more useful when you’re learning, or for high-stakes analysis
Creating Attack Trees
• Creating attack trees • for a project • for general use (very hard!)
• Steps: • Choose a representation • Create a root node (goal, “Get root”) • Add subnodes • Consider completeness • Prune • Check
Attack libraries
Libraries
• Collections of knowledge for you to apply • More structured than a mnemonic • More detailed than a tree • CAPEC is the most detailed library available today,
offering great structure
Checklists & Literature Search
• Checklists • Static
• Useful for commonly recurring threats
• May limit creativity
• Literature search • Review of past attacks
• Useful to leverage work on similar systems
Recap
• Memonics like STRIDE, trees, and libraries can all support finding threats—what can go wrong.
• The best tool is the one that works for you/your team • Those may be different
• Familiarity with a spectrum will help you
What's next?
• Quiz 2 • Due Sunday 11:59 PM
• 10 questions
• 20 minutes
• You have 2 chances (take highest grade)
• Reach chapters 6 and 7
