Attack Surface: 1. Inter-Service Message Manipulation
- Description: Attackers intercept, modify, or inject messages exchanged between Skynet services.
- Skynet Contribution: Skynet's core functionality is asynchronous message passing. The framework itself does not enforce message security, leaving it entirely to the application developer. This inherent design choice makes it a primary attack vector.
- Example: An attacker intercepts a "create user" message, modifies the requested privileges to "administrator," and forwards the altered message, gaining unauthorized administrative access.
- Impact: Data breaches, financial loss, unauthorized actions, system compromise, denial of service.
- Risk Severity: Critical
- Mitigation Strategies:
- Authentication: Mandatory strong authentication between all services. Verify the sender of every message (e.g., shared secrets, service-specific tokens).
- Authorization: Strict authorization checks on every message. Ensure the sender is allowed to send that message type to the receiver.
- Integrity: Mandatory message signing (e.g., HMAC) to prevent tampering.
- Confidentiality (Context-Dependent): Encrypt sensitive message payloads (lightweight encryption for internal, TLS for external).
- Input Validation: Rigorous validation of all message data on the receiving end. Treat all messages as potentially malicious.
- Rate Limiting: Limit message send/receive rates to prevent flooding.
Attack Surface: 2. Unauthorized Service Registration/Deregistration
- Description: Attackers register malicious services or deregister legitimate ones, disrupting application functionality.
- Skynet Contribution: Skynet's service management, by default, does not inherently restrict who can register or deregister services. This open design requires explicit security measures.
- Example: An attacker deregisters the authentication service, causing all subsequent requests to be processed without authentication, leading to unauthorized access.
- Impact: Denial of service, system instability, data breaches, unauthorized access.
- Risk Severity: High
- Mitigation Strategies:
- Centralized Authority: A single, trusted authority must handle all service registration/deregistration. This authority authenticates and authorizes all requests.
- Access Control: Strict ACLs or similar mechanisms to restrict registration/deregistration capabilities.
- Whitelisting: Only allow registration from a pre-approved whitelist of services.
- Monitoring: Continuous monitoring of service registrations/deregistrations with alerting on suspicious activity.
Attack Surface: 3. Lua Script Injection
- Description: Attackers inject malicious Lua code into the Skynet environment.
- Skynet Contribution: Skynet's heavy reliance on Lua for service logic and its dynamic nature create a direct pathway for code injection if input is not handled properly. The framework does not automatically sanitize input used in Lua scripts.
- Example: A service accepts a user-provided "script name" parameter, which is then directly used to load and execute a Lua script. The attacker provides a malicious script name, leading to arbitrary code execution.
- Impact: Arbitrary code execution, data breaches, system compromise, access to other services.
- Risk Severity: Critical
- Mitigation Strategies:
- Input Sanitization: Never directly embed user-provided data into Lua code. Rigorously sanitize all input before any use in a Lua context.
- Avoid Dynamic Script Generation: Eliminate or severely restrict dynamic Lua script generation from user input. Use pre-compiled, parameterized scripts.
- Secure Sandbox: Employ a robust, regularly updated Lua sandbox with strictly limited capabilities. Restrict access to Skynet APIs and system resources.
- Code Review: Mandatory, thorough code reviews of all Lua code, focusing on injection vulnerabilities.
Attack Surface: 4. Gate Bypass and Message Tampering
- Description: Attackers bypass the Skynet gate or manipulate messages passing through it.
- Skynet Contribution: The Skynet gate is a designed entry point for external communication. If not properly secured, it becomes a single point of failure for the entire system. Skynet does not enforce security on the gate by default.
- Example: An attacker discovers a flaw in the gate's authentication logic and connects directly to internal services, bypassing all security checks.
- Impact: Unauthorized access to internal services, data breaches, data manipulation, system compromise.
- Risk Severity: High
- Mitigation Strategies:
- Strong Authentication: Mandatory, robust authentication for all connections to the gate (e.g., TLS with client certificates, strong passwords with MFA).
- Authorization: Strict authorization rules to control client access to specific services through the gate.
- Encryption: Mandatory TLS to encrypt all communication through the gate.
- Message Integrity: Message signing (e.g., HMAC) to prevent tampering.
- Input Validation: Validate all data received through the gate.
- Regular Audits: Frequent security audits of the gate's configuration and code.
Attack Surface: 5. Malicious Snax Services
- Description: Attackers deploy or compromise Snax services to execute malicious code.
- Skynet Contribution: Snax is a Skynet-specific mechanism for extending functionality. Skynet itself does not validate the integrity or trustworthiness of Snax services. This places the responsibility entirely on the application developer.
- Example: An attacker publishes a Snax service that appears to provide useful functionality but secretly exfiltrates data.
- Impact: Arbitrary code execution, data breaches, system compromise.
- Risk Severity: High
- Mitigation Strategies:
- Source Verification: Only load Snax services from trusted, verified sources.
- Code Review: Mandatory, thorough code review of all Snax service code before loading.
- Sandboxing: Implement strong sandboxing or isolation to limit Snax service capabilities and prevent access to sensitive resources.
- Least Privilege: Run Snax services with the absolute minimum necessary privileges.