attack-tree.md

Attack Tree Analysis for arut/nginx-rtmp-module

Objective: Disrupt Service, Gain Unauthorized Access, or Execute Arbitrary Code

Attack Tree Visualization

                                      +-------------------------------------------------+
                                      |  Attacker Goal: Disrupt Service, Gain           |
                                      |  Unauthorized Access, or Execute Arbitrary Code |
                                      +-------------------------------------------------+
                                                        |
          +----------------------------------------------------------------------------------------------------------------+
          |                                                                                                                |
+-------------------------+                                      +--------------------------+                        +--------------------------------+
|  Denial of Service (DoS) |                                      | Unauthorized Stream Access |                        |  Remote Code Execution (RCE)  |
+-------------------------+                                      +--------------------------+                        +--------------------------------+
          |                                                                  |                                                 |
+---------+                                     +----------+                                      +---------+----------+
| Connection|                                     |  Bypass  |                                      |  Command |  Module    |
| Exhaustion|                                     |  Access  |                                      | Injection|Configuration|
|  [HIGH RISK]        |                                     | Controls |                                      |          |  Flaws     |
+---------+                                     | [HIGH RISK]              |                                      |  [HIGH RISK]        |          |
    |                                                 +----------+                                      +---------+----------+
    |                                                                                                                |
    |                                                                                                                |
    |                                                                                                      +---+       
    |                                                                                                      |exec|      
    |                                                                                                      |cmd|***   
    |                                                                                                      |   |       
    |                                                                                                      +---+       
    |
    +---------------------+
    |  Slowloris-style  |
    |  RTMP Connections |
    |  [HIGH RISK]        |
    +---------------------+

Attack Tree Path: Denial of Service (DoS) - High-Risk Paths

• Connection Exhaustion [HIGH RISK]

  • Description: An attacker attempts to overwhelm the server by opening a large number of RTMP connections without closing them. This consumes server resources (file descriptors, memory) and prevents legitimate clients from connecting.
  • Likelihood: Medium
  • Impact: Medium (Service Disruption)
  • Effort: Low
  • Skill Level: Novice
  • Detection Difficulty: Easy
  • Mitigation:
    • Implement connection limits using Nginx directives like limit_conn.
    • Set appropriate connection timeouts (timeout directive).
    • Monitor connection counts and alert on suspicious patterns.
    • Use a firewall to block IPs with excessive connection attempts.

• Slowloris-style RTMP Connections [HIGH RISK]

  • Description: Similar to the HTTP Slowloris attack, the attacker establishes RTMP connections but sends data very slowly. This keeps connections open for extended periods, consuming server resources and blocking legitimate clients.
  • Likelihood: Medium
  • Impact: Medium (Service Disruption)
  • Effort: Low
  • Skill Level: Intermediate
  • Detection Difficulty: Medium
  • Mitigation:
    • Configure appropriate timeouts for RTMP connections (e.g., timeout directive). Ensure the server doesn't wait indefinitely for data.
    • Monitor connection states and identify slow clients.
    • Use Nginx's limit_req directive (although primarily for HTTP, it can offer some protection).

Attack Tree Path: Unauthorized Stream Access - High-Risk Path

• Bypass Access Controls [HIGH RISK]
  • Description: The attacker exploits weaknesses in the module's authentication or authorization mechanisms to gain access to streams they shouldn't have access to. This could involve manipulating stream keys, exploiting flaws in allow/deny rules, or bypassing on_publish/on_play script checks.
  • Likelihood: Low
  • Impact: High (Unauthorized Access to Streams)
  • Effort: Medium
  • Skill Level: Intermediate
  • Detection Difficulty: Medium
  • Mitigation:
    • Thoroughly test all access control configurations.
    • Use strong authentication (secure passwords, tokens).
    • Regularly audit access logs.
    • Ensure on_publish and on_play scripts are secure and do not leak information or allow unauthorized access. Apply secure coding practices to these scripts.
    • Use a whitelist approach for allowed stream keys/paths.
    • Implement multi-factor authentication if possible.

Attack Tree Path: Remote Code Execution (RCE) - High-Risk Paths and Critical Nodes

• Command Injection [HIGH RISK]

  • Description: If the exec directive is used and incorporates user-supplied input without proper sanitization, an attacker can inject arbitrary commands to be executed on the server.
  • Likelihood: Low (but very high if exec is used improperly)
  • Impact: Very High (Complete System Compromise)
  • Effort: High
  • Skill Level: Advanced
  • Detection Difficulty: Hard
  • Mitigation:
    • Avoid exec if possible. Find alternative solutions that don't involve executing external commands.
    • If exec is unavoidable:
      • Whitelist: Strictly control the allowed commands and arguments. Never allow arbitrary commands.
      • Input Validation: Rigorously validate and sanitize all input using a whitelist approach.
      • Least Privilege: Run the spawned process with the absolute minimum necessary privileges.
      • Sandboxing: Isolate the executed process using chroot, containers, or other sandboxing techniques.

• Exploit Module Configuration Flaws [HIGH RISK]

  • Description: Incorrect or insecure configurations of the module itself can create vulnerabilities. This is a broad category, encompassing various misconfigurations.
  • Likelihood: Low
  • Impact: High/Very High (depending on the specific flaw)
  • Effort: Medium
  • Skill Level: Intermediate/Advanced
  • Detection Difficulty: Medium/Hard
  • Mitigation:
    • Follow the principle of least privilege.
    • Disable unnecessary features and directives.
    • Regularly review and audit the configuration.
    • Use a configuration management tool.
    • Validate configuration against known best practices.

• Critical Node: exec command ()*

  • Description: The exec directive itself is a critical node. Any use of exec introduces significant risk, and its misuse is a direct path to command injection.
  • Mitigation: (Same as Command Injection above - this is the most critical point to address)

• Critical Node: on_publish (within Bypass Access Controls)

  • Description: If on_publish uses a script, vulnerabilities in that script can be exploited.
  • Mitigation:
    • Secure coding practices for the script.
    • Rigorous input validation.
    • Run the script with minimum privileges.