Skip to content

Latest commit

 

History

History
63 lines (52 loc) · 6.25 KB

threat-modeling.md

File metadata and controls

63 lines (52 loc) · 6.25 KB

Threat Model Analysis for facebook/facebook-android-sdk

Threat: Access Token Theft via Unsecured Storage

  • Threat: Access Token Theft via Unsecured Storage
    • Description: An attacker gains access to the device's storage (e.g., through a malicious app, physical access, or exploiting an Android vulnerability) and reads the Facebook access token stored insecurely by the application. The attacker can then use this token to impersonate the user on Facebook. This directly involves the SDK because the application uses the SDK's AccessToken object, and the vulnerability lies in how the application chooses to store that object provided by the SDK.
    • Impact: User account compromise, unauthorized access to user data, potential for fraudulent activities using the user's identity, reputational damage to the application.
    • Affected Component: AccessToken class (storage and handling), Application's implementation of token storage (using the SDK-provided object).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Use EncryptedSharedPreferences or the Android Keystore system for storing the AccessToken.
      • Avoid storing the token in plain text, logs, or easily accessible locations.
      • Implement root detection and warn users or disable Facebook integration if the device is compromised.

Threat: Access Token Leakage via Logging or Debugging

  • Threat: Access Token Leakage via Logging or Debugging
    • Description: The application inadvertently logs the AccessToken (an object provided by the SDK) to system logs, debug outputs, or crash reports. An attacker with access to these logs (e.g., through a malicious app or physical access) can steal the token. The direct SDK involvement is the use and potential mishandling of the AccessToken object.
    • Impact: User account compromise, unauthorized access to user data, potential for fraudulent activities.
    • Affected Component: AccessToken class (handling), Application's logging and debugging practices (related to the SDK object).
    • Risk Severity: High
    • Mitigation Strategies:
      • Disable logging of sensitive information, including access tokens, in production builds.
      • Use a secure logging library that automatically redacts sensitive data.
      • Review all logging and debugging code to ensure no accidental exposure of tokens.
      • Use ProGuard or R8 to obfuscate code and remove unused logging statements.

Threat: Man-in-the-Middle (MitM) Attack on Login Flow

  • Threat: Man-in-the-Middle (MitM) Attack on Login Flow
    • Description: An attacker intercepts the network communication between the application and Facebook's servers during the login process managed by the SDK. They could potentially steal the access token or modify the login response. While the SDK should use HTTPS, the threat lies in potential failures in the application's verification of the HTTPS connection used by the SDK.
    • Impact: User account compromise, unauthorized access to user data, potential for data manipulation.
    • Affected Component: LoginManager, CallbackManager, Network communication handled by the SDK.
    • Risk Severity: High
    • Mitigation Strategies:
      • Ensure the application properly validates the SSL/TLS certificates used by Facebook's servers (certificate pinning is a strong option, but requires careful management). This is crucial even though the SDK handles the connection.
      • Monitor for SSL/TLS errors and warnings, and do not proceed with the login if any issues are detected.
      • Use a VPN or other secure network connection when using the application on untrusted networks.

Threat: Deep Link Hijacking to Steal Authorization Code

  • Threat: Deep Link Hijacking to Steal Authorization Code
    • Description: The application uses deep links to handle the Facebook login redirect as part of the SDK's login flow. A malicious app registers the same deep link scheme, intercepting the authorization code sent by Facebook. The attacker can then exchange this code for an access token. The SDK's LoginManager is directly involved in setting up and handling this redirect.
    • Impact: User account compromise, unauthorized access to user data.
    • Affected Component: LoginManager (specifically the redirect URI handling), Application's deep link configuration (used in conjunction with the SDK).
    • Risk Severity: High
    • Mitigation Strategies:
      • Use App Links (Android) instead of custom URL schemes for deep linking. App Links are verified by the operating system, preventing hijacking.
      • If custom URL schemes are necessary, use a unique and unpredictable scheme.
      • Implement additional checks in the deep link handler to verify the source of the request, even when using the SDK.

Threat: Exploiting a Vulnerability in the Facebook SDK

  • Threat: Exploiting a Vulnerability in the Facebook SDK
    • Description: A security vulnerability is discovered in a specific version of the Facebook SDK itself. An attacker crafts an exploit that leverages this vulnerability to gain unauthorized access to user data or perform other malicious actions. This is a direct threat to the SDK.
    • Impact: Varies depending on the vulnerability, but could range from data leakage to complete account compromise.
    • Affected Component: Any component of the SDK could be affected, depending on the vulnerability.
    • Risk Severity: Varies (High to Critical, depending on the vulnerability)
    • Mitigation Strategies:
      • Keep the Facebook SDK updated to the latest version.
      • Monitor Facebook's developer blog and security advisories for announcements of vulnerabilities and patches.
      • Implement a process for quickly deploying SDK updates in response to security vulnerabilities.