Skip to content

Latest commit

 

History

History
77 lines (58 loc) · 5.14 KB

threat-modeling.md

File metadata and controls

77 lines (58 loc) · 5.14 KB

Threat Model Analysis for grpc/grpc-go

Threat: Unauthenticated Client Access

  • Threat: Unauthenticated Client Access

    • Description: An attacker connects to the gRPC server and invokes methods without providing valid credentials. This exploits the absence of authentication enforcement within the grpc-go server setup.
    • Impact: Unauthorized access to sensitive data/functionality, data breaches, system compromise.
    • Affected Component: grpc.Server (specifically, the lack of authentication interceptors before request handling), credentials package (if TLS/mTLS is not enforced).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Implement mandatory authentication using server-side interceptors (grpc.UnaryInterceptor, grpc.StreamInterceptor).
      • Use TLS with mutual authentication (mTLS) (credentials.NewTLS with a properly configured tls.Config).
      • Employ a secure token-based system (e.g., JWT) and validate tokens in the interceptor.

Threat: Man-in-the-Middle (MITM) Attack

  • Threat: Man-in-the-Middle (MITM) Attack

    • Description: An attacker intercepts gRPC communication, eavesdropping or modifying messages. This directly exploits weaknesses in the TLS configuration or the absence of TLS within the grpc-go setup.
    • Impact: Data breach, data tampering, loss of confidentiality and integrity.
    • Affected Component: credentials package (improper TLS configuration), grpc.Dial (client-side, if server verification is disabled).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Always use TLS for all gRPC communication.
      • Clients must verify the server's certificate against a trusted CA (configure tls.Config correctly).
      • Servers should use valid certificates from a trusted CA.

Threat: Data Tampering in Transit

  • Threat: Data Tampering in Transit

    • Description: An attacker modifies gRPC messages in transit. This is only possible if TLS is not used or is compromised, making it a direct consequence of improper grpc-go configuration.
    • Impact: Incorrect data processing, unauthorized actions, denial of service, data integrity compromise.
    • Affected Component: The lack of TLS usage or a compromised TLS connection directly impacts the security of data handled by grpc.Server and grpc.ClientConn.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Enforce TLS for all gRPC communication. This is the primary defense.

Threat: Denial of Service (DoS) via Resource Exhaustion

  • Threat: Denial of Service (DoS) via Resource Exhaustion

    • Description: An attacker floods the gRPC server with requests or large messages, exhausting resources. This directly targets the grpc.Server and its handling of incoming connections and messages.
    • Impact: Service unavailability, disruption of operations.
    • Affected Component: grpc.Server, grpc.MaxRecvMsgSize, grpc.MaxSendMsgSize (if not configured).
    • Risk Severity: High
    • Mitigation Strategies:
      • Implement rate limiting using server-side interceptors.
      • Set timeouts for gRPC calls (context.WithTimeout).
      • Configure grpc.MaxRecvMsgSize and grpc.MaxSendMsgSize.
      • Use connection pooling.

Threat: Slowloris Attack

  • Threat: Slowloris Attack

    • Description: An attacker establishes many connections but sends data slowly, tying up server resources. This directly targets the connection handling of the grpc.Server.
    • Impact: Service unavailability.
    • Affected Component: grpc.Server (connection handling).
    • Risk Severity: High
    • Mitigation Strategies:
      • Configure appropriate timeouts for connections and read/write operations (using net.ListenConfig with KeepAlive settings).

Threat: Unauthorized Method Invocation (Bypassing Authorization)

  • Threat: Unauthorized Method Invocation (Bypassing Authorization)

    • Description: An authenticated client invokes methods they are not authorized to access. This highlights a failure in the authorization logic within the grpc-go server's interceptor chain.
    • Impact: Unauthorized access to data/functionality, data modification/deletion, system integrity compromise.
    • Affected Component: grpc.Server (specifically, the absence or incorrect implementation of authorization checks in server-side interceptors before the handler).
    • Risk Severity: High
    • Mitigation Strategies:
      • Implement robust authorization checks in server-side interceptors.
      • Use a well-defined authorization model (RBAC, ABAC).
      • Ensure checks are performed for every method call.