Skip to content

Latest commit

 

History

History
92 lines (74 loc) · 7.92 KB

attack-tree.md

File metadata and controls

92 lines (74 loc) · 7.92 KB

Attack Tree Analysis for airbnb/okreplay

Objective: Compromise Application Using OkReplay

Attack Tree Visualization

Compromise Application Using OkReplay
├───[HIGH RISK PATH] 1. Exploit Cassette Manipulation
│   ├───[HIGH RISK PATH] 1.1 Modify Existing Cassette Content
│   │   └───[CRITICAL NODE] 1.1.1 Access Cassette Storage Location
│   ├───[HIGH RISK PATH] 1.2 Replace Cassette with Malicious Cassette
│   │   └───[CRITICAL NODE] 1.2.1 Access Cassette Storage Location
│   └───[CRITICAL NODE] 1.3.1 Access Cassette Storage Location
├───[HIGH RISK PATH] 2. Exploit Cassette Storage Vulnerabilities
│   ├───[HIGH RISK PATH] 2.1 Unsecured Cassette Storage Location
│   │   ├───[CRITICAL NODE] 2.1.1 Identify Storage Location
│   │   └───[CRITICAL NODE] 2.1.2 Lack of Access Controls
│   ├───[HIGH RISK PATH] 2.2 Cassette Data Leakage
│   │   └───[CRITICAL NODE] 2.2.1 Cassettes Contain Sensitive Data
│   └───[CRITICAL NODE] 2.3.1 Access Cassette Storage Location
└───[HIGH RISK PATH] 4. Exploit Misconfiguration/Accidental Production Use
    ├───[HIGH RISK PATH] 4.1 OkReplay Enabled in Production Build
    │   └───[CRITICAL NODE] 4.1.1 Application Deployed with OkReplay Interceptor Active
    └───[HIGH RISK PATH] 4.3 Accidental Exposure of Cassettes in Production
        └───[CRITICAL NODE] 4.3.1 Cassette Storage Location Becomes Publicly Accessible

Attack Tree Path: 1. Exploit Cassette Manipulation (High-Risk Path):

  • Attack Vector: Attackers aim to alter the behavior of the application by manipulating the cassette files that OkReplay uses to replay network responses. This path is high-risk because successful manipulation directly impacts the application's logic and data flow.

    • 1.1 Modify Existing Cassette Content (High-Risk Path):

      • Attack Vector: Attackers modify the content of legitimate cassette files. This could involve changing response bodies, headers, or status codes to inject malicious data or bypass security checks.
        • Critical Node: 1.1.1 Access Cassette Storage Location:
          • Attack Vector: Gaining unauthorized access to the location where cassette files are stored. This is the foundational step for all cassette manipulation attacks. Common access methods include:
            • Local File System Access (e.g., on Android devices if cassettes are on external storage with weak permissions).
            • Network Share Access (if cassettes are stored on a network share with compromised credentials or weak security).
            • Server-Side Access (if cassettes are stored on a server accessible through web application vulnerabilities or compromised server accounts).

    • 1.2 Replace Cassette with Malicious Cassette (High-Risk Path):

      • Attack Vector: Attackers replace legitimate cassette files entirely with their own crafted malicious cassettes. This allows for complete control over the replayed responses and application behavior.
        • Critical Node: 1.2.1 Access Cassette Storage Location:
          • Attack Vector: Same as 1.1.1 - Unauthorized access to the cassette storage location is required to replace cassettes.

    • Critical Node: 1.3.1 Access Cassette Storage Location:

      • Attack Vector: While "Corrupt Cassette Data" path itself is not marked as High-Risk, accessing the storage location (1.3.1) is still a critical node because it's a prerequisite for potential Denial of Service attacks by corrupting cassettes.

Attack Tree Path: 2. Exploit Cassette Storage Vulnerabilities (High-Risk Path):

  • Attack Vector: Attackers target vulnerabilities in how and where cassettes are stored. This path is high-risk because it can lead to both cassette manipulation and data leakage.

    • 2.1 Unsecured Cassette Storage Location (High-Risk Path):

      • Attack Vector: Cassettes are stored in locations that are easily accessible to unauthorized parties due to misconfiguration or weak default settings.
        • Critical Node: 2.1.1 Identify Storage Location:
          • Attack Vector: Discovering the location where cassettes are stored. This is often achieved through:
            • Static analysis of the application code to find hardcoded paths.
            • Predictable default storage locations used by OkReplay or common development practices.
        • Critical Node: 2.1.2 Lack of Access Controls:
          • Attack Vector: The storage location lacks proper access controls, making cassettes readable and writable by unauthorized users or processes. Examples include:
            • World-readable directories on servers.
            • External storage on Android with insufficient permission restrictions.

    • 2.2 Cassette Data Leakage (High-Risk Path):

      • Attack Vector: Cassettes inadvertently contain sensitive data, and insecure storage or transmission leads to the exposure of this data.
        • Critical Node: 2.2.1 Cassettes Contain Sensitive Data:
          • Attack Vector: Cassettes are recorded with sensitive information included in requests or responses. This can include:
            • API keys and authentication tokens.
            • Personally Identifiable Information (PII).
            • Other confidential business data.

    • Critical Node: 2.3.1 Access Cassette Storage Location:

      • Attack Vector: Similar to 1.3.1, accessing the storage location is critical even for less impactful attacks like Denial of Service via cassette manipulation.

Attack Tree Path: 4. Exploit Misconfiguration/Accidental Production Use (High-Risk Path):

  • Attack Vector: This path focuses on risks arising from improper configuration or accidental deployment of OkReplay in production environments. This is high-risk because it can directly expose production systems to vulnerabilities intended for development/testing.

    • 4.1 OkReplay Enabled in Production Build (High-Risk Path):

      • Attack Vector: OkReplay interceptors and recording/playback mechanisms are mistakenly included and active in a production build of the application.
        • Critical Node: 4.1.1 Application Deployed with OkReplay Interceptor Active:
          • Attack Vector: The application is deployed to a production environment with OkReplay's network interception functionality still enabled. This can lead to:
            • Recording of live production traffic into cassettes, potentially capturing sensitive data.
            • The application relying on cassettes in production, making it vulnerable to cassette manipulation attacks.

    • 4.3 Accidental Exposure of Cassettes in Production (High-Risk Path):

      • Attack Vector: Even if OkReplay is not actively used in production, cassettes created during development or testing are accidentally deployed to production servers and become publicly accessible.
        • Critical Node: 4.3.1 Cassette Storage Location Becomes Publicly Accessible:
          • Attack Vector: The directory or location where cassettes are stored on a production server is misconfigured, making it publicly accessible via the web or other means. This can lead to:
            • Data leakage if cassettes contain sensitive information.
            • Potential replay attacks if the application logic in production can be influenced by these exposed cassettes.