Component: DZ App
Primary DZ application and interface, executed on the host machine
Potential Mitigations
Properties not currently implemented that would mitigate applicable threats:
Threats Affecting This Component
| Threat ID | Name | Description | Potential Mitigations |
|---|---|---|---|
| CAPEC-131 | Resource Leak Exposure | An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests. | is resource constrained |
| CAPEC-23 | File Content Injection | An adversary poisons files with a malicious payload (targeting the file systems accessible by the target software), which may be passed through by standard channels such as via email, and standard web content like PDF and multimedia files. The adversary exploits known vulnerabilities or handling routines in the target processes, in order to exploit the host's trust in executing remote content, including binary files. | is sandboxed |
| DZ-1-UPD | verifies resources · updates | ||
| CAPEC-186 | Malicious Software Update | An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source. | verifies resources · updates |
| DZ-2-BUILD | is reproducible is verifiable | ||
| DZ-2-CODE | is reviewed | ||
| CAPEC-639 | Probe System Files | An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information. | is sandboxed |
| CAPEC-153 | Input Data Manipulation | An attacker exploits a weakness in input validation by controlling the format, structure, and composition of data to an input-processing interface. By supplying input of a non-standard or unexpected form an attacker can adversely impact the security of the target. | is sandboxed |
| CAPEC-444 | Development Alteration | An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. These attacks generally require insider access to modify source code or to tamper with hardware components. The product is then delivered to the user where the negative impact can be leveraged at a later time. | is reviewed |