CAPEC-440: Hardware Integrity Attack

An adversary exploits a weakness in the system maintenance process and causes a change to be made to a technology, product, component, or sub-component or a new one installed during its deployed use at the victim location for the purpose of carrying out an attack.

Comment

This CAPEC threat is about manipulated hardware, for which there's no mitigation.

High

Severity

occurrences in scenarios

Frequency

Affected Components

Affected Scenarios

Requirements and Mitigations

Requirements

Component properties that must be true for this threat to apply:

Mitigations

Component properties that mitigate this threat:

Affected Components

Component	Description	Boundary
Certum Card	Hardware security module for Windows code signing	FPF-operated Tailnet
Build machines	Build machines (Mac minis) operated by FPF Infra	FPF-operated Tailnet
YubiKey	Hardware security key	FPF-operated Tailnet

Affected Scenarios

release — affects: Build machines Certum Card YubiKey

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "10. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "11. Create GitHub\nrelease";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "12. Embed sandbox\npublic key";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Update release\nreference";    ]
}

release_basic — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Create GitHub\nrelease";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Update release\nreference";    ]
}

release_signatures — affects: Build machines Certum Card YubiKey

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Create GitHub\nrelease";    ]
}

release_sandbox — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Cosign_Binary__build_machines__FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(build machines)";
            URL = "component_Cosign_Binary__build_machines_.html";
            tooltip = "Cosign Binary (build machines)";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Push container to\nGHCR";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign remote\nsandbox image";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Publish rekor\nlogs";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Request signed\nsandbox tarball";    ]
    externalentity_GitHub_Container_Registry_Internet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Response with the\nsigned sandbox +\nsignatures";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Cosign_Binary__build_machines__FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Generate the\nsandbox tarball from\nthe pulled container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Tag remote\nsandbox";    ]
}

Back to Summary