Skip to content

Latest commit

 

History

History
85 lines (72 loc) · 7.04 KB

attack-surface.md

File metadata and controls

85 lines (72 loc) · 7.04 KB

Attack Surface Analysis for ipfs/go-ipfs

Attack Surface: Denial of Service (DoS) / DDoS via Resource Exhaustion

  • Description: Attackers overwhelm the go-ipfs node with requests, consuming resources (CPU, memory, bandwidth, storage) and making it unavailable.
  • How go-ipfs Contributes: go-ipfs's P2P architecture and protocols (Bitswap, DHT, connection management) are inherently vulnerable to resource exhaustion. The open nature of the network means any node can attempt to interact with the go-ipfs instance.
  • Example: An attacker floods the node with Bitswap requests for random, non-existent CIDs, causing high CPU and bandwidth usage.
  • Impact: Application downtime, service unavailability, potential financial losses, node becomes unusable.
  • Risk Severity: High
  • Mitigation Strategies:
    • Rate Limiting: Use go-ipfs's built-in rate limiting and implement additional application-level rate limiting on all incoming requests (Bitswap, DHT, connections).
    • Connection Limits: Configure strict connection limits using go-ipfs's connection manager.
    • Resource Quotas: Set limits on storage (especially pinning) and bandwidth.
    • Firewall: Restrict network access to only necessary ports/IPs.
    • Monitoring: Continuously monitor resource usage and alert on anomalies.

Attack Surface: Serving Malicious Content

  • Description: The application retrieves and uses content from IPFS without sufficient validation, leading to the execution or display of malicious data.
  • How go-ipfs Contributes: While go-ipfs guarantees content integrity (it matches the CID), it does not guarantee content safety. go-ipfs provides the mechanism to retrieve the data, but the application is responsible for validating it.
  • Example: An application retrieves a JavaScript file from IPFS based on a user-provided CID and executes it without sanitization, leading to a cross-site scripting (XSS) attack.
  • Impact: Compromise of user accounts, data breaches, malware infections, reputational damage.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Content Validation: Never trust content from IPFS directly. Implement rigorous validation before use:
      • Allowlisting: Only allow content from trusted CIDs/sources.
      • Sandboxing: Execute/render content in a sandboxed environment.
      • Virus Scanning: Scan for malware.
      • Content Type Verification: Verify and enforce expected content types.
    • CID Verification: If possible, verify the CID against a trusted source before retrieval.

Attack Surface: Data Tampering (Mutable Content)

  • Description: Attackers compromise keys used for mutable pointers (IPNS, DNSLink), redirecting users to malicious content.
  • How go-ipfs Contributes: IPNS and DNSLink, features of go-ipfs, provide mutability, but their security depends entirely on the associated keys. go-ipfs manages the resolution and update mechanisms for these pointers.
  • Example: An attacker compromises the private key for an IPNS record and updates it to point to a phishing site.
  • Impact: Users are redirected to malicious content, leading to malware, phishing, etc.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Secure Key Management: Protect private keys with extreme care (strong passwords, MFA, HSMs).
    • Key Rotation: Regularly rotate keys used for IPNS and DNSLink.
    • DNSSEC (for DNSLink): Use DNSSEC to prevent DNS hijacking.
    • Monitoring: Monitor IPNS/DNSLink entries for unauthorized changes.
    • Multi-Signature: Consider multi-signature schemes for updating IPNS.

Attack Surface: Exposed API Endpoints

  • Description: The go-ipfs HTTP API is exposed without proper authentication/authorization, allowing attackers to control the node.
  • How go-ipfs Contributes: go-ipfs provides the HTTP API, which is a powerful interface for controlling the node. Its security is entirely dependent on proper configuration.
  • Example: An attacker finds the exposed API and uses it to add malicious files, delete data, or reconfigure the node.
  • Impact: Complete node compromise, data exfiltration, potential RCE, use of the node for malicious activities.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Authentication: Implement strong authentication (API keys, JWTs). Never use default credentials.
    • Authorization: Implement fine-grained authorization to restrict API access.
    • Network Segmentation: Do not expose the API publicly unless strictly necessary. Use a reverse proxy with TLS and access controls.
    • Firewall: Restrict access to the API port to authorized IPs.
    • Auditing: Regularly audit API configuration and access logs.

Attack Surface: Data Confidentiality Breach

  • Description: Sensitive data is stored on IPFS without encryption, making it publicly accessible via its CID.
  • How go-ipfs Contributes: IPFS, by its design, does not provide confidentiality. It's a public, content-addressed network. go-ipfs implements this design.
  • Example: An application stores unencrypted user data on IPFS, and an attacker who obtains the CIDs can access the data.
  • Impact: Data breaches, privacy violations, legal/regulatory consequences.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Encryption: Always encrypt sensitive data before storing it on IPFS.
    • Client-Side Encryption: Encrypt data on the client-side to ensure it's never stored unencrypted.
    • Access Control (Application-Level): Control access to decryption keys and encrypted data.
    • Metadata Minimization: Minimize stored metadata to reduce leakage.

Attack Surface: Dependency Vulnerabilities

  • Description: Vulnerabilities in go-ipfs's dependencies (libp2p, other Go libraries) are exploited.
  • How go-ipfs Contributes: go-ipfs includes and relies on these dependencies. A vulnerability in a dependency becomes a vulnerability in go-ipfs.
  • Example: A vulnerability in a libp2p component allows RCE; an attacker exploits this to control the go-ipfs node.
  • Impact: Varies (DoS to RCE, node compromise).
  • Risk Severity: High to Critical
  • Mitigation Strategies:
    • Regular Updates: Keep go-ipfs and dependencies updated. Use go mod.
    • Vulnerability Scanning: Use tools to identify known vulnerabilities.
    • Software Composition Analysis (SCA): Use SCA tools to track dependencies and vulnerabilities.
    • Supply Chain Security: Be aware of supply chain risks; consider code signing and SBOMs.