Skip to content

Latest commit

 

History

History
82 lines (65 loc) · 5.7 KB

attack-tree.md

File metadata and controls

82 lines (65 loc) · 5.7 KB

Attack Tree Analysis for mutualmobile/mmdrawercontroller

Objective: Unauthorized Drawer Access/DoS (Critical Node)

Attack Tree Visualization

                                      +-----------------------------------------------------+
                                      ||  Attacker's Goal: Unauthorized Drawer Access/DoS  ||
                                      +-----------------------------------------------------+
                                                       |
          +==================================================================================+
          ||                                                                                  ||
          +-------------------------+                                                        +-------------------------+
          |  1. Exploit Logic Flaws  |                                                        || 2. Bypass Authentication ||
          +-------------------------+                                                        +-------------------------+
                                     ||                                                                                 ||
                                     ||                                                                                 +---------+---------+
                                     ||                                                                                 || 2.1     | 2.2     ||
                                     ||                                                                                 || Drawer  | Improper||
                                     ||                                                                                 || Content | State   ||
                                     ||                                                                                 || Access  | Checks  ||
                                     ||                                                                                 +---------+---------+
                                     ||                                                                                                ||
          +---------+               ||                                                                                 +---------+
          | 1.1.2   |               ||                                                                                 || 2.2.1   ||
          | Unauth. |               ||                                                                                 || Missing ||
          | Drawer  |               ||                                                                                 || Auth    ||
          | Open/   |               ||                                                                                 || Checks  ||
          | Close   |               ||                                                                                 ||         ||
          +---------+               ||                                                                                 +---------+

Attack Tree Path: 2. Bypass Authentication (Critical Node)

  • Description: The attacker circumvents the intended authentication mechanisms to gain access to content or functionality within the drawer that should be protected.
  • Likelihood: Low to Medium
  • Impact: High to Very High
  • Effort: Low to Medium
  • Skill Level: Novice to Intermediate
  • Detection Difficulty: Medium to Hard

Attack Tree Path: 2.1 Drawer Content Access (Critical Node)

  • Description: The attacker directly accesses the drawer's content without providing valid credentials. This indicates a failure in the application's logic to enforce authentication before displaying the drawer or its contents.
  • Likelihood: Low to Medium
  • Impact: High to Very High
  • Effort: Low to Medium
  • Skill Level: Novice to Intermediate
  • Detection Difficulty: Medium to Hard

Attack Tree Path: 2.2 Improper State Checks (Critical Node)

  • Description: The application fails to correctly check the user's authentication state in relation to the drawer, allowing access even when the user is not properly authenticated.
  • Likelihood: Low
  • Impact: High to Very High
  • Effort: Very Low
  • Skill Level: Novice
  • Detection Difficulty: Easy to Medium

Attack Tree Path: 2.2.1 Missing Authentication Checks (Critical Node)

  • Description: The most severe vulnerability. The application completely omits authentication checks before displaying the drawer or its contents. This is a fundamental security flaw.
  • Likelihood: Low
  • Impact: High to Very High
  • Effort: Very Low
  • Skill Level: Novice
  • Detection Difficulty: Easy

Attack Tree Path: 1. Exploit Logic Flaws

Attack Tree Path: 1.1.2 Unauthorized Drawer Open/Close (Critical Node)

  • Description: The attacker manages to open or close the drawer without the necessary authorization, potentially bypassing intended access controls and revealing protected content or features. This might involve directly invoking methods or manipulating properties related to the drawer's state.
  • Likelihood: Low to Medium
  • Impact: Medium to High
  • Effort: Medium
  • Skill Level: Intermediate
  • Detection Difficulty: Medium to Hard