Misbehaviour LocalLossOfUserTW

URI: LocalLossOfUserTW

Description: Untrusted, potentially malicious agents gained access to a host, with user rights (possibly associated with a specific process), when the host is in a specific location and/or connected to a specific subnet.

This misbehaviour affects the trustworthiness attribute UserTW

AccessContext	Model of access rights, restricted to specific contexts.
Host	A device that can store, process, transmit or receive data.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

H.L.IoH.3

Remote user access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected service listening on LogicalSubnet .

H.L.NoH.3

P.L.CCCLnSAC.1

Compromise or impersonation of Client allows access to SHost via Service: if anyone can access Service as Client, then because Service is a remote access service, they can access SHost.

P.L.CCCSAC.3

Remote control of Service using a back door from Client: if a back door has previously been installed in service Service, an attacker with control of client Client can exploit the back door to gain access to the rights of Service on its host SHost.

P.L.CSAPNaS.3

Remote control of service Service using a back door from LogicalSubnet: an attacker with access to LogicalSubnet can exploit a privileged network path to Service via that subnet, and use a previously installed back door to take control of the service, gaining access to the rights of Service on SHost.

P.L.HuHW2ACE.3

Execution of malicious email attachment at WebBrowser on Host in Space: user Human runs a malicious file sent as an email attachment via MUA, allowing the attacker to exploit the privileges of their browser WebBrowser on device Host using network connections it has from location Space.

P.L.OSAPNaS.3

P.L.SPNaLnS.1

Remote access to login service Service via reverse proxy Client: a malicious user or an attacker who can authenticate with reverse proxy Client can send messages via Client to a back-end login service Service, gaining access to its rights on device SHost.

P.L.SPNaS.3

Remote control of process Service using a back door via proxy Client: a malicious user or an attacker who can send messages via reverse proxy Client to a back-end service Service could access a back door if previously installed in the software, and gain control of Service including its access to its rights on device SHost.

H.L.HAC.4

Attacker exploit gains user privileges at Host in location Space: the attacker exploits a vulnerability in device Host when it is located in Space, and gains user level access to the device in that context.

P.L.HPAC.4

Attacker exploit takes control of Process in Space: the attacker exploits a vulnerability in process Process when its host Host is located in Space, giving them control of the process behaviour and access to its privileges on Host when in that location.

H.L.HmAC.0

Access to Host in all contexts by unauthorized agents: if untrustworthy actors gain access to a host, the best case trustworthiness of its users in any context is degraded.

H.L.HsAC.0

Access to Host in any context by an unauthorized agent: if an untrustworthy actor gains access to a host, the worst case trustworthiness of its users in any context is degraded.

P.L.HPmAC.0

Access to the rights of Process by unauthorized agents in all contexts : if untrustworthy actors gain access to Host with the rights of Process, the best case trustworthiness of its users in any context is degraded.

P.L.HPsAC.0

Access to the rights of Process by unauthorized agents in any context: if an untrustworthy actor gains access to Host with the rights of Process in any context, the worst case trustworthiness of its users in any context is degraded.

DS.A.HPsACDAdDS.1

Use of Process to prevent access to Data: someone with the rights of Process on its host device Host can exploit the rights of Process to delete the locally stored copy of Data.

DS.A.HsACDS.1.3

Use of user privileges at Host to control availability of Data: anyone with user privileges at Host can delete or otherwise prevent access to copies of Data stored on the Host.

DS.Auth.HPsACd-pDS-V.1

Use of Process to alter Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to serve and update the locally stored copy of Data.

DS.Auth.HPsACdpDS-V.1

Use of Process to alter Data on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to process and update the locally stored copy of Data.

DS.Auth.HPsACd-pDS-V.1.6

Use of compromised key at Process to alter Data stored on Host: someone with the rights of Process on its host device Host can alter the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.

DS.Auth.HsACDS-V.1.3

Use of user privileges at Host to alter Data stored on Host: anyone with user privileges at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.

DS.C.HPsACr-pDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and serve the locally stored copy of Data.

DS.C.HPsACrpDS-V.1

DS.C.HPsACr-pDS-V.1.6

Use of compromised key at Process to access Data stored on Host: someone with the rights of Process on its host device Host can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.

DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.

LS.L.HL1HS.1

Access to RemoteHost in Space allows communication via USB or Bluetooth with Host: someone with access to device RemoteHost in location Space where it is paired with device Host can use the pairing connection to communicate with Host.

H.L.HmAC.1

Access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host, it must be assumed they can use Host in any context.

H.L.SHmACPAC.1

Use of privileges at Process to access Host in Space: anyone with local rights (i.e. at command shell level) for process Process when the host is in location Space also has user level access to its host Host in the same context.

H.M.SHmACRLnSAC.1

Use of login via RemoteAccessService to control Host in Space: anyone with local rights (i.e. at command shell level) for root remote access service RemoteAccessService controlling Host when it is in location Space also has admin rights on Host in the same context.

LS.L.HL3S.1

Access to Host allows local communication on subnet LogicalSubnet: someone with access to Host can send messages on LogicalSubnet to which Host is connected.

P.A.HP-iT.1.3

Use of privileges at Process to control availability: anyone with local user rights (i.e. local control) of a process Process can shut it down. However, this does not prevent access where there are other instances of Process running on independent instances of Host.

P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.

P.L.HPmAC.1

Access to Process by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host with the rights of Process, then they could exploit those rights in any context.

P.L.SHLnSACPmAC.1

Use of login via RemoteAccessService to control Process on Host in Space: anyone with local rights (i.e. at command shell level) for remote access service RemoteAccessService controlling the collocated process Process on Host when it is in location Space also has control of Process in that context.

CC.AuC.CACHcLSS.1

Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.

CC.L.CSHSAC.1

Client Client affected by access to compromised service Service via LogicalSubnet: if Service can be controlled by the wrong person (i.e. an attacker) in a context where it is accessed by client Client, they can alter the behaviour of Service towards Client.

DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.

DF.C.AC-iDF-VTC.3.6

DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.

DS.C.HPsACrDSCCV.1

H.V.HAC.2

Local authenticated exploit on device Host when in location Space: an attacker with local user level access to device Host in location Space exploits a bug in Host.

H.V.HL1HS.2

Authenticated exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, after authentication, can exploit a bug in Host.

H.V.HL1HS.3

Anonymous exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, without authentication, can exploit a bug in Host.

H.V.IoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.

H.V.LoH.2

Adjacent authenticated exploit on device Host from LogicalSubnet: an attacker with local access to device Host when connected to subnet LogicalSubnet can send a message containing malicious content that, after authentication, can exploit a bug in Host.

H.V.NoH.2

P.V.HACPmAC.2

Local authenticated exploit on process Process in Space: an attacker with local user access to device Host in space Space can exploit a bug in Process.