Skip to content

Latest commit

 

History

History
89 lines (79 loc) · 5.43 KB

attack-tree.md

File metadata and controls

89 lines (79 loc) · 5.43 KB

Attack Tree Analysis for borgbackup/borg

Objective: Gain Unauthorized Access to, Modify, or Destroy Data or Compromise Backup Integrity (Borg-Related)

Attack Tree Visualization

                                     +-----------------------------------------------------+
                                     | Gain Unauthorized Access to, Modify, or Destroy Data |
                                     |     or Compromise Backup Integrity (Borg-Related)    |
                                     +-----------------------------------------------------+
                                                        |
         +--------------------------------+-------------------------------+-------------------------------+
         |                                |                               |
+--------+--------+           +--------+--------+          +--------+--------+
|  Compromise   |           |  Exploit   |          |  Tamper with  |
|  Repository   |           |  Borg      |          |  Configuration|
|  Credentials  |           |Vulnerabilities|          |     Files     |
|  (CRITICAL)    |           |               |          |               |
+--------+--------+           +--------+--------+          +--------+--------+
         |                                |                               |
+--------+--------+           +--------+--------+          +--------+--------+
|  Phishing/    |           |  Known CVEs  |          |  Incorrect    |
|Social Eng.   |           | (e.g.,       |          |  Permissions  |
|  (HIGH RISK)  |           |  related to  |          |   (CRITICAL)  |
+--------+--------+           |  parsing,    |          +--------+--------+
|  Compromised  |           |  crypto)     |          |  Missing      |
|  SSH Keys    |           +--------+--------+          |  Encryption  |
|  (HIGH RISK)  |           |  Dependency  |          |  (at rest/   |
+--------+--------+           |  Vulnerabilities|          |  in transit) |
                               |  (HIGH RISK)  |          |   (CRITICAL)  |
                               +--------+--------+          +--------+--------+

Attack Tree Path: Compromise Repository Credentials (CRITICAL NODE)

  • Description: This is the central point of attack. If an attacker gains the credentials needed to access the Borg repository (passphrase, SSH keys, etc.), they have effectively full control over the backups.
  • Attack Vectors:
    • Phishing/Social Engineering (HIGH RISK):
      • Description: Tricking users or administrators into revealing their credentials through deceptive emails, websites, or other communication.
      • Likelihood: Medium to High
      • Impact: High to Very High
      • Effort: Low to Medium
      • Skill Level: Low to Medium
      • Detection Difficulty: Medium to High
    • Compromised SSH Keys (HIGH RISK):
      • Description: Obtaining a user's or administrator's SSH private key, often through theft, malware, or misconfiguration.
      • Likelihood: Low to Medium
      • Impact: High to Very High
      • Effort: Low (if unprotected) to High (if passphrase-protected)
      • Skill Level: Low to Medium
      • Detection Difficulty: Medium to High

Attack Tree Path: Exploit Borg Vulnerabilities

  • Attack Vectors: * Known CVEs (HIGH RISK): * Description: Exploiting publicly known vulnerabilities in BorgBackup for which patches may or may not be available, or have not been applied. * Likelihood: Medium * Impact: Medium to Very High * Effort: Low to Medium * Skill Level: Low to High * Detection Difficulty: Low to Medium * Dependency Vulnerabilities (HIGH RISK): * Description: Exploiting vulnerabilities in libraries that Borg depends on. These vulnerabilities can be in any part of the dependency chain. * Likelihood: Medium * Impact: Medium to Very High * Effort: Low to Medium * Skill Level: Low to High * Detection Difficulty: Low to Medium

Attack Tree Path: Tamper with Configuration Files

  • Attack Vectors: * Incorrect Permissions (CRITICAL NODE): * Description: Exploiting misconfigured file permissions on Borg's configuration files or the repository itself, allowing unauthorized modification or access. * Likelihood: Low to Medium * Impact: Medium to High * Effort: Low * Skill Level: Low * Detection Difficulty: Low to Medium * Missing Encryption (at rest/in transit) (CRITICAL NODE): * Description: Exploiting the lack of encryption to intercept or modify backup data either while it's being transferred (in transit) or while it's stored (at rest). * Likelihood: Low (if Borg is configured correctly) * Impact: High to Very High * Effort: Low (for interception) to Medium (for modification) * Skill Level: Low to Medium * Detection Difficulty: Medium to High