Scenario: update

Install or update

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_release_server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub release\nserver";
            URL = "component_GitHub_release_server.html";
            tooltip = "GitHub release server";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Check for newer\nreleases";    ]
    externalentity_DZ_GitHub_repo_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Send changelog\nfor new release and\nprompt user to\ninstall";    ]
    actor_User_Local_host -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Check\ndangerzone.rocks for\nlatest install";    ]
    server_dangerzone_rocks_Internet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. (Linux) Redirect\nto installation docs";    ]
    actor_User_Local_host -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. (Linux) Request\nbinary/image";    ]
    server_DZ_Linux_package_server_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. (Linux) Receive\nbinary/image";    ]
    server_dangerzone_rocks_Internet -> externalentity_GitHub_release_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. (Win / macOS)\nRedirects to GH\nrelease page\nbinaries";    ]
    server_dangerzone_rocks_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. (Win / macOS)\nReceive install\nbinary";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant User as User
    link User: Component @ component_User.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant GitHub_release_server as GitHub release server
    link GitHub_release_server: Component @ component_GitHub_release_server.html

    DZ_App->>DZ_GitHub_repo: 1. Check for newer releases
    DZ_GitHub_repo-->>DZ_App: 2. Send changelog for new release and prompt user to install
    User->>dangerzone_rocks: 3. Check dangerzone.rocks for latest install
    dangerzone_rocks->>DZ_GitHub_repo: 4. (Linux) Redirect to installation docs
    User->>DZ_Linux_package_server: 5. (Linux) Request binary/image
    DZ_Linux_package_server->>Host_storage: 6. (Linux) Receive binary/image
    dangerzone_rocks->>GitHub_release_server: 7. (Win / macOS) Redirects to GH release page binaries
    dangerzone_rocks->>Host_storage: 8. (Win / macOS) Receive install binary

Show data flows

ID	Name	Source	Sink	Type
1	Check for newer releases	DZ App	DZ GitHub repo	Request
2	Send changelog for new release and prompt user to install	DZ GitHub repo	DZ App	Response to Check for newer releases
3	Check dangerzone.rocks for latest install	User	dangerzone.rocks	Request
4	(Linux) Redirect to installation docs	dangerzone.rocks	DZ GitHub repo	Request
5	(Linux) Request binary/image	User	DZ Linux package server	Request
6	(Linux) Receive binary/image	DZ Linux package server	Host storage	Request
7	(Win / macOS) Redirects to GH release page binaries	dangerzone.rocks	GitHub release server	Request
8	(Win / macOS) Receive install binary	dangerzone.rocks	Host storage	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-UPD		DZ App	verifies resources.updates
DZ-2-CODE		DZ App	is reviewed
DZ-2-BUILD		DZ App	is reproducible is verifiable
DZ-2-BUILD		Release Changelog	is reproducible is verifiable
CAPEC-23	File Content Injection	DZ App	is sandboxed
CAPEC-131	Resource Leak Exposure	DZ App	is resource constrained
CAPEC-153	Input Data Manipulation	DZ App	is sandboxed
CAPEC-186	Malicious Software Update	DZ App	verifies resources.updates
CAPEC-439	Manipulation During Distribution	dangerzone.rocks	is verifiable
CAPEC-439	Manipulation During Distribution	GitHub release server	is verifiable
CAPEC-444	Development Alteration	DZ App	is reviewed
CAPEC-582	Route Disabling	DZ GitHub repo	works offline
CAPEC-582	Route Disabling	dangerzone.rocks	works offline
CAPEC-582	Route Disabling	DZ Linux package server	works offline
CAPEC-582	Route Disabling	GitHub release server	works offline
CAPEC-639	Probe System Files	DZ GitHub repo	is sandboxed
CAPEC-639	Probe System Files	DZ App	is sandboxed
CAPEC-639	Probe System Files	Release Changelog	is sandboxed
CAPEC-639	Probe System Files	dangerzone.rocks	is sandboxed
CAPEC-639	Probe System Files	DZ Linux package server	is sandboxed
CAPEC-639	Probe System Files	DZ release binary	is sandboxed
CAPEC-639	Probe System Files	Embedded Sandbox	is sandboxed
CAPEC-639	Probe System Files	Embedded Log Index	is sandboxed
CAPEC-639	Probe System Files	GitHub release server	is sandboxed

Back to Summary