Skip to content

Latest commit

 

History

History
137 lines (120 loc) · 8.42 KB

attack-tree.md

File metadata and controls

137 lines (120 loc) · 8.42 KB

Attack Tree Analysis for eclipse-mosquitto/mosquitto

Objective: To gain unauthorized access to sensitive data transmitted via MQTT, disrupt the application's functionality by manipulating MQTT messages, or take control of the MQTT broker itself.

Attack Tree Visualization

                                     +-----------------------------------------------------+
                                     |  Attacker's Goal: Gain Unauthorized Access/Control  |
                                     |  or Disrupt Application via Mosquitto Broker       |
                                     +-----------------------------------------------------+
                                                        |
         +--------------------------------+--------------------------------+--------------------------------+
         |                                |                                |
+--------+--------+             +--------+--------+             +--------+--------+
|  Denial of      |             |  Man-in-the-   |             |  Exploit Broker  |
|  Service (DoS)  |             |  Middle (MitM)  |             |  Vulnerabilities|
+--------+--------+             +--------+--------+[CN]         +--------+--------+[CN]
         |                                |                                |
+--------+--------+             +--------+--------+             +--------+--------+
| Flood Broker   |[HR]         | Intercept/     |             | Buffer Overflow|
| with Messages  |             | Modify Traffic |             | (CVE-XXXX-YYYY)|[HR][CN]
+--------+--------+             +--------+--------+[CN]         +--------+--------+
         |                                |                                |
         |                                +--------+--------+                    |
         |                                |  - TLS         |                    |
         |                                |    Stripping   |[HR]                  |
         |                                +--------+--------+                    |
         |                                |  - Downgrade   |                    |
         |                                |    to Plaintext|[HR]                  |
         |                                +--------+--------+                    |
         |                                         |                                |
         |                                +--------+--------+                    |
         |                                |  - Eavesdrop   |[HR]                  |
         |                                |    on Traffic  |                    |
         |                                +--------+--------+                    |
         |                                         |                                |
         |                                +--------+--------+                    |
         |                                |  - Inject      |[HR]                  |
         |                                |    False Data  |                    |
         |                                +--------+--------+                    |
         |
+--------+--------+
|  Compromise     |
|  Authentication |[HR][CN]
+--------+--------+
         |
+--------+--------+
| Brute-Force    |
| Credentials    |[HR]
+--------+--------+
         |
+--------+--------+
| Weak/Default   |
| Credentials    |[CN]
+--------+--------+

Attack Tree Path: 1. Denial of Service (DoS) - Flood Broker with Messages [HR]

  • Description: The attacker sends a massive number of MQTT messages (CONNECT, PUBLISH, SUBSCRIBE) to the broker, overwhelming its resources (CPU, memory, network bandwidth).
  • Likelihood: High. Easy to execute with readily available tools. Effectiveness depends on broker configuration and resources.
  • Impact: High. Can render the MQTT service unavailable to legitimate clients, disrupting application functionality.
  • Effort: Low. Can be automated with simple scripts.
  • Skill Level: Novice.
  • Detection Difficulty: Medium. High network traffic and resource utilization are observable, but distinguishing malicious traffic from legitimate bursts can be challenging without proper monitoring and thresholds.

Attack Tree Path: 2. Man-in-the-Middle (MitM) [HR] (if TLS is not enforced)

  • Intercept/Modify Traffic [CN]:

    • Description: The attacker positions themselves between the client and the broker to intercept, modify, or replay MQTT messages. This is the critical enabling step for the rest of the MitM attacks.

    • Likelihood: Low (with TLS), High (without TLS). Requires network access.

    • Impact: Very High. Complete compromise of confidentiality and integrity.

    • Effort: Medium to High.

    • Skill Level: Intermediate to Advanced.

    • Detection Difficulty: Medium to Hard (without TLS), Very Hard (with TLS).

    • TLS Stripping [HR]:

      • Description: The attacker actively removes TLS encryption from the connection, forcing it to fall back to plaintext.
      • Likelihood: Low (if TLS is enforced by both client and server).
      • Impact: Very High. Allows eavesdropping and manipulation.
      • Effort: Medium to High.
      • Skill Level: Intermediate to Advanced.
      • Detection Difficulty: Hard.

    • Downgrade to Plaintext [HR]:

      • Description: Similar to TLS stripping, but focuses on preventing TLS negotiation from the start.
      • Likelihood: Low (if TLS is enforced).
      • Impact: Very High.
      • Effort: Medium to High.
      • Skill Level: Intermediate to Advanced.
      • Detection Difficulty: Hard.

    • Eavesdrop on Traffic [HR]:

      • Description: Passively listening to unencrypted MQTT messages.
      • Likelihood: Low (with TLS), High (without TLS).
      • Impact: High (if sensitive data is transmitted).
      • Effort: Low (without TLS).
      • Skill Level: Novice (without TLS).
      • Detection Difficulty: Very Hard (with TLS), Easy (without TLS).

    • Inject False Data [HR]:

      • Description: Actively modifying or injecting MQTT messages.
      • Likelihood: Low (with TLS), High (without TLS).
      • Impact: High to Very High.
      • Effort: Medium.
      • Skill Level: Intermediate.
      • Detection Difficulty: Hard.

Attack Tree Path: 3. Exploit Broker Vulnerabilities [CN]

  • Buffer Overflow (CVE-XXXX-YYYY) [HR][CN]:
    • Description: Exploiting a specific, known buffer overflow vulnerability in Mosquitto (represented by a CVE identifier). This is a placeholder; real CVEs would be listed.
    • Likelihood: Low to Medium (depends on the specific CVE and patch status). Higher if the vulnerability is unpatched and an exploit is publicly available.
    • Impact: Very High. Often leads to Remote Code Execution (RCE).
    • Effort: High to Very High. Requires finding the vulnerability, developing or obtaining an exploit.
    • Skill Level: Advanced to Expert.
    • Detection Difficulty: Hard to Very Hard (especially for zero-days). Requires IDS/IPS with specific signatures or behavioral analysis.

Attack Tree Path: 4. Compromise Authentication [HR][CN]

*   **Brute-Force Credentials [HR]:**
    *   **Description:** Repeatedly guessing usernames and passwords.
    *   **Likelihood:** Medium to High (depends on password strength and lockout policies).
    *   **Impact:** High.  Grants attacker access to the broker.
    *   **Effort:** Low to Medium.
    *   **Skill Level:** Novice to Intermediate.
    *   **Detection Difficulty:** Medium (detectable through failed login attempts).

*   **Weak/Default Credentials [CN]:**
    *   **Description:** Using easily guessable or default passwords that haven't been changed.
    *   **Likelihood:** Low to Medium (depends on administrative practices).
    *   **Impact:** High.  Immediate access.
    *   **Effort:** Very Low.
    *   **Skill Level:** Novice.
    *   **Detection Difficulty:** Easy (if successful).