Misbehaviour ConnectionsAllowed

URI: ConnectionsAllowed

Package: NetworkConnectivity

< prev | next >

Description: Applies to a network communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets, signifying that by default, messages will be allowed to flow.

This misbehaviour affects the trustworthiness attribute ConnectionsBlocked

Interface

The interface between a Host and a Logical Subnet. Represents a possible point of control and a target for attack. If the Logical Subnet is an IP network, the Interface also represents the existence of an IP address.

LogicalPath

Base class for network paths.

LogicalSegment

A base class representing a route through a Host between any two distinct Logical Subnets of any kind.

ConnectionsAllowed
Sg.DA.L1SSg2AC.1

Mesh routing between FromHost and ToHost not disabled at reenabled at Gateway: if an attacker has admin rights on host Gateway, they can override a policy not to enable mesh routing between paired hosts.
ConnectionsAllowed
Sg.TA.L1SSg2.8

Mesh routing between FromHost and ToHost via Gateway is enabled: if this route is enabled by mesh routing via non-IP connections, it could be exploited by an attacker.
ConnectionsAllowed
Sg.TA.LTethSg2.8

Routing between Host and LogicalSubnet via Gateway is enabled: if this route is enabled by tethering between the IP and non-IP connections, it could be exploited by an attacker.
ConnectionsAllowed
Sg.TA.LTethSg2AC.1

Tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is paired with Host and connected to LogicalSubnet, then they can tether Gateway and connect Host to LogicalSubnet.
ConnectionsAllowed
Sg.TA.LTRevSg2.8

Routing from Host and LogicalSubnet via Gateway is enabled: if this route is enabled by reverse tethering between the IP and non-IP connections, it could be exploited by an attacker.
ConnectionsAllowed
Sg.TA.LTRevSg2AC.1

Reverse tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is connected to LogicalSubnet and Host is paired with it, then they can reverse tether Host and connect Host to LogicalSubnet.
ConnectionsAllowed
I.DA.I.8

Access to Host from LogicalSubnet enabled: if the network connection between Host and LogicalSubnet is in service, then messages addressed to Host will be accepted via that connection, unless blocked by a firewall policy.
ConnectionsAllowed
NP.DA.NPLS.8

Network path across LogicalSubnet enters service: the subnet LogicalSubnet being in service means messages can be sent across it.
ConnectionsAllowed
NP.DA.NPmLSmSg.8

Network path from FromSubnet to ToSubnet enters service: if the logical subnets on this path are in service, and gateways do not block message routing between subnets, then messages can be sent on the end-to-end path.
ConnectionsAllowed
Sg.DA.L3SSg2AC-b.1

Routing between FromSubnet and ToSubnet re-disabled at Gateway: if an attacker has admin rights on host Gateway in a context where it is connected to FromSubnet and ToSubnet, then they can override a default policy to drop connection being routed between those subnets.
ConnectionsAllowed
Sg.DA.L3SSg2-b.8

Routing between FromSubnet and ToSubnet via Gateway is enabled by default: if this route between IP subnets is enabled for all communications, it could be exploited by an attacker.

        (empty)

ConnectionsAllowed
H.L.IoH.3

Remote user access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected service listening on LogicalSubnet .
ConnectionsAllowed
H.L.NoH.3

Remote user access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected service listening on LogicalSubnet .
ConnectionsAllowed
H.M.IoH.3

Remote root access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected yet privileged service listening on LogicalSubnet .
ConnectionsAllowed
H.M.NoH.3

Remote root access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected yet privileged service listening on LogicalSubnet .
ConnectionsAllowed
H.M.RIoH.7

Remote root access from AttackerSubnet via LogicalSubnet to back door on device Host: an attacker with access to AttackerSubnet gains access to host Host via a previously installed back door providing a reverse shell via LogicalSubnet .
ConnectionsAllowed
H.M.RNoH.7

Remote root access from AttackerSubnet via LogicalSubnet to back door on device Host: an attacker with access to AttackerSubnet gains access to host Host via a previously installed back door providing a reverse shell via LogicalSubnet .
ConnectionsAllowed
I.O.DDoH.3

Remote DDoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker able to orchestrate clients on subnet AttackerSubnet arranges for them to send too many messages to the network address of the target device Host on LogicalSubnet.
ConnectionsAllowed
I.O.IoH.3

Remote DoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker with remote access to Layer 3 subnet LogicalSubnet sends too many messages to the network address of the target device Host on LogicalSubnet.
ConnectionsAllowed
I.O.RoH.3

Remote DoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker with remote access to Layer 3 subnet LogicalSubnet sends too many messages to the network address of the target device Host on LogicalSubnet.
ConnectionsAllowed
NP.DA.NPmLSmSg.8

Network path from FromSubnet to ToSubnet enters service: if the logical subnets on this path are in service, and gateways do not block message routing between subnets, then messages can be sent on the end-to-end path.
ConnectionsAllowed
I.TA.I.8.1

Access to services on Host from LogicalSubnet enabled by default: if the interface between Host and LogicalSubnet is in service and connections to Host via this interface are allowed by default, then so are connections to services running on Host.
ConnectionsAllowed
Sg.TA.L3SSg2-b.8.1

Service connections from FromSubnet to ToSubnet via Gateway allowed by default: if the route via Gateway from FromSubnet to ToSubnet is not blocked, then service connections cannot be blocked.
ConnectionsAllowed
H.V.IoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.
ConnectionsAllowed
H.V.IoH.3

Remote anonymous exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, without authentication, can exploit a vulnerability in Host.
ConnectionsAllowed
H.V.NoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.
ConnectionsAllowed
H.V.NoH.3

Remote anonymous exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, without authentication, can exploit a vulnerability in Host.