Skip to content

Latest commit

 

History

History
63 lines (50 loc) · 8.06 KB

attack-tree.md

File metadata and controls

63 lines (50 loc) · 8.06 KB

Attack Tree Analysis for facebook/hermes

Objective: Attacker's Goal: To compromise application that use Hermes by exploiting high-risk weaknesses or vulnerabilities.

Attack Tree Visualization

High-Risk Attack Tree: Compromise Application Using Hermes (High-Risk Paths)

Root Goal: Compromise Application Using Hermes [CRITICAL NODE]
    * Exploit Vulnerabilities in Hermes Bytecode Handling [CRITICAL NODE] [HIGH RISK PATH]
        * Malicious Bytecode Injection [HIGH RISK PATH]
            * Man-in-the-Middle (MitM) Attack during App Download/Update [HIGH RISK PATH]
                * Intercept and replace legitimate app package with modified bytecode [HIGH RISK PATH]
    * Exploit Vulnerabilities in Hermes JavaScript Engine Core
        * Prototype Pollution [HIGH RISK PATH]
            * Exploit prototype pollution vulnerabilities in Hermes's JavaScript environment to modify object behavior globally [HIGH RISK PATH]
            * Use prototype pollution to escalate privileges or bypass security checks within the application's JavaScript code [HIGH RISK PATH]
    * Exploit Vulnerabilities in Hermes Integration with React Native and Native Environment [CRITICAL NODE] [HIGH RISK PATH]
        * Bridge Exploitation [HIGH RISK PATH]
            * Vulnerabilities in React Native Bridge Communication [HIGH RISK PATH]
                * Intercept and manipulate messages passed between JavaScript (Hermes) and native code [HIGH RISK PATH]
                * Exploit serialization/deserialization flaws in bridge communication to inject malicious data or code [HIGH RISK PATH]
            * Insecure Native Modules Exposed to Hermes [HIGH RISK PATH]
                * Identify and exploit vulnerabilities in native modules that are accessible from JavaScript code running in Hermes [HIGH RISK PATH]
                * Abuse insecure APIs exposed by native modules to gain access to sensitive device resources or functionalities [HIGH RISK PATH]

Attack Tree Path: 1. Root Goal: Compromise Application Using Hermes [CRITICAL NODE]

  • Description: This is the overarching objective of the attacker. Success at any of the sub-paths leads to achieving this goal to varying degrees.
  • Attack Vectors (Summarized by Sub-Paths):
    • Exploiting bytecode handling vulnerabilities.
    • Exploiting prototype pollution in the JavaScript engine.
    • Exploiting weaknesses in the integration with React Native and native components.

Attack Tree Path: 2. Exploit Vulnerabilities in Hermes Bytecode Handling [CRITICAL NODE] [HIGH RISK PATH]

  • Description: Targeting the way Hermes processes and executes bytecode. This is a high-risk area because bytecode is the compiled form of the application's logic, and vulnerabilities here can lead to direct code execution control.
  • Attack Vectors:
    • Malicious Bytecode Injection [HIGH RISK PATH]: Injecting crafted bytecode into the application's execution flow.
      • Man-in-the-Middle (MitM) Attack during App Download/Update [HIGH RISK PATH]: Intercepting the application download or update process to replace legitimate bytecode with malicious bytecode.
        • Intercept and replace legitimate app package with modified bytecode [HIGH RISK PATH]: Specifically, during app download or update, an attacker intercepts the network traffic and substitutes the original application package (containing bytecode) with a modified version containing attacker-controlled bytecode. This allows the attacker to execute arbitrary code when the application is installed or updated.

Attack Tree Path: 3. Exploit Vulnerabilities in Hermes JavaScript Engine Core -> Prototype Pollution [HIGH RISK PATH]

  • Description: Exploiting prototype pollution vulnerabilities within the Hermes JavaScript engine. Prototype pollution is a JavaScript-specific vulnerability where attackers can modify the prototype of built-in JavaScript objects, leading to unexpected behavior and potentially security breaches across the application's JavaScript code.
  • Attack Vectors:
    • Exploit prototype pollution vulnerabilities in Hermes's JavaScript environment to modify object behavior globally [HIGH RISK PATH]: Attackers inject JavaScript code that manipulates the prototypes of global objects (like Object.prototype, Array.prototype, etc.). This modification affects all objects created in the JavaScript environment, potentially altering application logic or creating backdoors.
    • Use prototype pollution to escalate privileges or bypass security checks within the application's JavaScript code [HIGH RISK PATH]: By polluting prototypes, attackers can modify the behavior of objects used in security-sensitive parts of the application. This can lead to bypassing authentication, authorization checks, or other security mechanisms implemented in JavaScript.

Attack Tree Path: 4. Exploit Vulnerabilities in Hermes Integration with React Native and Native Environment [CRITICAL NODE] [HIGH RISK PATH]

  • Description: Targeting the interface and communication pathways between the Hermes JavaScript runtime and the native application environment (React Native bridge, native modules). This is a critical area because it bridges the JavaScript logic with native device functionalities and resources.
  • Attack Vectors:
    • Bridge Exploitation [HIGH RISK PATH]: Targeting vulnerabilities in the React Native bridge, which is the communication channel between JavaScript and native code.
      • Vulnerabilities in React Native Bridge Communication [HIGH RISK PATH]: Exploiting weaknesses in how data is transmitted and processed across the bridge.
        • Intercept and manipulate messages passed between JavaScript (Hermes) and native code [HIGH RISK PATH]: Attackers intercept communication between JavaScript and native code. By manipulating these messages, they can alter the data being exchanged, potentially injecting malicious commands or data into the native side or modifying the application's state.
        • Exploit serialization/deserialization flaws in bridge communication to inject malicious data or code [HIGH RISK PATH]: Vulnerabilities in how data is serialized (converted to a format for transmission) and deserialized (converted back to its original format) across the bridge. Attackers can craft malicious payloads that, when deserialized on the native side, lead to buffer overflows, code execution, or other vulnerabilities in the native code.
      • Insecure Native Modules Exposed to Hermes [HIGH RISK PATH]: Exploiting vulnerabilities within native modules that are exposed to JavaScript code running in Hermes. Native modules provide access to device-specific functionalities and can be a point of weakness if not securely implemented.
        • Identify and exploit vulnerabilities in native modules that are accessible from JavaScript code running in Hermes [HIGH RISK PATH]: Native modules themselves might contain security vulnerabilities (e.g., buffer overflows, injection flaws, logic errors). Attackers can identify and exploit these vulnerabilities by interacting with the native modules from JavaScript code running in Hermes.
        • Abuse insecure APIs exposed by native modules to gain access to sensitive device resources or functionalities [HIGH RISK PATH]: Even if native modules are not vulnerable in themselves, they might expose APIs that, when misused or called in unexpected sequences from JavaScript, can lead to security breaches. This could involve gaining unauthorized access to device resources (camera, microphone, location, storage), bypassing permissions, or triggering unintended native functionalities.