Dangerzone Threat Model

CAPEC-113: Interface Manipulation

An adversary manipulates the use or processing of an interface (e.g. Application Programming Interface (API) or System-on-Chip (SoC)) resulting in an adverse impact upon the security of the system implementing the interface. This can allow the adversary to bypass access control and/or execute functionality not intended by the interface implementation, possibly compromising the system which integrates the interface. Interface manipulation can take on a number of forms including forcing the unexpected use of an interface or the use of an interface in an unintended way.

Examples

An adversary may make a request to an application that leverages a non-standard API that is known to incorrectly validate its data and thus it may be manipulated by supplying metacharacters or alternate encodings as input, resulting in any number of injection flaws, including SQL injection, cross-site scripting, or command execution.::API methods not intended for production, such as debugging or testing APIs, may not be disabled when deploying in a production environment. As a result, dangerous functionality can be exposed within the production environment, which an adversary can leverage to execute additional attacks.::SoC components contain insufficient identifiers, which allows an adversary to reset the device at will or read sensitive data from the device.

Medium
Severity
1
occurrences in scenarios
Frequency
1
Affected Components
1
Affected Scenarios

Requirements and Mitigations

Requirements

Component properties that must be true for this threat to apply:

reads input is exposed

Mitigations

Component properties that mitigate this threat:

sanitizes input is sandboxed

Affected Components

Component Description Boundary
Cosign Binary (build machines) Cosign binary running on the build machine FPF-operated Tailnet

Affected Scenarios

release_sandbox — affects: Cosign Binary (build machines)

Back to Summary