CAPEC-276: Inter-component Protocol Manipulation

Inter-component protocols are used to communicate between different software and hardware modules within a single computer. Common examples are: interrupt signals and data pipes. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.

Unknown

Severity

occurrences in scenarios

Frequency

Affected Components

Affected Scenarios

Requirements and Mitigations

Requirements

Component properties that must be true for this threat to apply:

Mitigations

Component properties that mitigate this threat:

Affected Components

Component	Description	Boundary
Cosign Binary (build machines)	Cosign binary running on the build machine	FPF-operated Tailnet
Container manager	Podman on Linux, and Podman Machine on Windows/macOS	Local host

Affected Scenarios

convert — affects: Container manager

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_Random_doc_source_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Random doc\nsource";
            URL = "component_Random_doc_source.html";
            tooltip = "Random doc source";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        subgraph cluster_boundary_Docker_Podman_VM {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <Docker/Podman VM>;
            ]

            subgraph cluster_boundary_Outer_container {
                graph [
                    fontsize = 10;
                    fontcolor = black;
                    style = dashed;
                    color = firebrick2;
                    label = <Outer container>;
                ]

                subgraph cluster_boundary_gVisor_sandbox {
                    graph [
                        fontsize = 10;
                        fontcolor = black;
                        style = dashed;
                        color = firebrick2;
                        label = <gVisor sandbox>;
                    ]

                    component_LibreOffice_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "LibreOffice";
                        URL = "component_LibreOffice.html";
                        tooltip = "LibreOffice";
                        margin = 0.02;
                    ]

                    component_doc_to_pixels_py_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "doc_to_pixels.py";
                        URL = "component_doc_to_pixels_py.html";
                        tooltip = "doc_to_pixels.py";
                        margin = 0.02;
                    ]

                }

                component_entrypoint_py_Outer_container [
                    shape = circle;
                    color = black;
                    fontcolor = black;
                    label = "entrypoint.py";
                    URL = "component_entrypoint_py.html";
                    tooltip = "entrypoint.py";
                    margin = 0.02;
                ]

            }

            component_Container_runtime_Docker_Podman_VM [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "Container\nruntime";
                URL = "component_Container_runtime.html";
                tooltip = "Container runtime";
                margin = 0.02;
            ]

        }

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        component_PDF_reader_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "PDF reader";
            URL = "component_PDF_reader.html";
            tooltip = "PDF reader";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    actor_User_Local_host -> externalentity_Random_doc_source_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Request untrusted\ndoc from remote\nsource";    ]
    externalentity_Random_doc_source_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Receive untrusted\ndoc from remote\nsource and store it\nlocally";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "3. Start the\nDangerzone App";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Invoke\nDocker/Podman to\ncheck if the\ncontainer image is\npresent and\ninstalled";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "5. Is the image\npresent in the VM?";    ]
    component_Container_runtime_Docker_Podman_VM -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Image is present";    ]
    component_Container_manager_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Reply to\nDangerzone APP that\nthe container image\nis installed";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Select documents\nfor conversion";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "9. Request a Linux\ncontainer for\nconversion";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "10. Start a Linux\ncontainer";    ]
    component_Container_runtime_Docker_Podman_VM -> component_entrypoint_py_Outer_container [        color = black;        fontcolor = black;        dir = forward;        label = "11. Run entrypoint\nscript of Linux\ncontainer";    ]
    component_entrypoint_py_Outer_container -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "12. Start the\nDangerzone converter\nin the gVisor\nsandbox";    ]
    component_DZ_App_Local_host -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "13. Send the\nsuspicious document\nto the stdin of the\ngVisor sandbox";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_LibreOffice_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "14. Convert the\nsuspicious doc to\nPDF (if not already)";    ]
    component_LibreOffice_gVisor_sandbox -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "15. Receive\nsuspicious doc as\nPDF";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "16. Rasterize PDF\ninto pixels and\nwrite them to the\ngVisor sandbox's\nstdout";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "17. Reconstruct a\nsafe doc from pixels\nto PDF (and\noptionally OCR it)";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "18. Save safe PDF\nwith a '-safe.pdf'\nprefix";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "19. Archive the\nsuspicious PDF into\nthe 'unsafe/'\ndirectory";    ]
    component_DZ_App_Local_host -> component_PDF_reader_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "20. Open the PDF\nusing the program of\nthe user's choice,\nor the default one";    ]
}

release_sandbox — affects: Cosign Binary (build machines)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Cosign_Binary__build_machines__FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(build machines)";
            URL = "component_Cosign_Binary__build_machines_.html";
            tooltip = "Cosign Binary (build machines)";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Push container to\nGHCR";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign remote\nsandbox image";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Publish rekor\nlogs";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Request signed\nsandbox tarball";    ]
    externalentity_GitHub_Container_Registry_Internet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Response with the\nsigned sandbox +\nsignatures";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Cosign_Binary__build_machines__FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Generate the\nsandbox tarball from\nthe pulled container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Tag remote\nsandbox";    ]
}

upgrade_sandbox — affects: Container manager

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Cosign_Binary__embedded__Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(embedded)";
            URL = "component_Cosign_Binary__embedded_.html";
            tooltip = "Cosign Binary (embedded)";
            margin = 0.02;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> actor_User_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "1. Should enable\nsandbox updates?";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. User consent";    ]
    component_DZ_App_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Query registry";    ]
    externalentity_GitHub_Container_Registry_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Registry response";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. Store remote log\nindex";    ]
    datastore_Host_storage_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Read current log\nindex";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Pull sandbox\nimage";    ]
    component_DZ_App_Local_host -> component_Cosign_Binary__embedded__Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Verify sandbox\nsignatures";    ]
    component_Cosign_Binary__embedded__Local_host -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Verify rekor log";    ]
    component_Cosign_Binary__embedded__Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signature\nverification result";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "11. Store signatures";    ]
    component_Container_manager_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "12. Install sandbox";    ]
    component_Container_manager_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Pull sandbox\nimage";    ]
}

Back to Summary