Misbehaviour ServiceChannelsAllowed

URI: ServiceChannelsAllowed

Description: Applies to a communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets. Signifies that exceptions do exist allowing client-service connections and communications to tunnel through a default deny routing policy.

This misbehaviour affects the trustworthiness attribute ServiceChannelsBlocked

Interface	The interface between a Host and a Logical Subnet. Represents a possible point of control and a target for attack. If the Logical Subnet is an IP network, the Interface also represents the existence of an IP address.
LogicalSegment	A base class representing a route through a Host between any two distinct Logical Subnets of any kind.

Sg.DA.L1SSg2AC.1

Mesh routing between FromHost and ToHost not disabled at reenabled at Gateway: if an attacker has admin rights on host Gateway, they can override a policy not to enable mesh routing between paired hosts.

Sg.TA.L1SSg2.8

Mesh routing between FromHost and ToHost via Gateway is enabled: if this route is enabled by mesh routing via non-IP connections, it could be exploited by an attacker.

Sg.TA.LTethSg2.8

Routing between Host and LogicalSubnet via Gateway is enabled: if this route is enabled by tethering between the IP and non-IP connections, it could be exploited by an attacker.

Sg.TA.LTethSg2AC.1

Tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is paired with Host and connected to LogicalSubnet, then they can tether Gateway and connect Host to LogicalSubnet.

Sg.TA.LTRevSg2.8

Routing from Host and LogicalSubnet via Gateway is enabled: if this route is enabled by reverse tethering between the IP and non-IP connections, it could be exploited by an attacker.

Sg.TA.LTRevSg2AC.1

Reverse tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is connected to LogicalSubnet and Host is paired with it, then they can reverse tether Host and connect Host to LogicalSubnet.

I.TA.I.8.1

Access to services on Host from LogicalSubnet enabled by default: if the interface between Host and LogicalSubnet is in service and connections to Host via this interface are allowed by default, then so are connections to services running on Host.

I.TA.I.8.2

Access to services on Host from LogicalSubnet enabled by exception: if the interface between Host and LogicalSubnet is in service, then even if connections to Host via that interface are blocked by default, connections to services running on Host will be allowed unless explicitly disabled.

Sg.TA.L3SSg2+b.8.2

Port forwarding from FromSubnet to ToSubnet via Gateway is enabled: if the route from public subnet FromSubnet to private subnet ToSubnet via a NAT gateway host Gateway is in service, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.

Sg.TA.L3SSg2-b.8.1

Service connections from FromSubnet to ToSubnet via Gateway allowed by default: if the route via Gateway from FromSubnet to ToSubnet is not blocked, then service connections cannot be blocked.

Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

(empty)

SC.IS.SCmSg.8.1

Privileged channel between Client and Service in service: if all routes via gateways plus the final interface to the service host are enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.

SC.IS.SCpSg.8.1

Privileged channel between Client and Service in service: if access to Service from LogicalSubnet is enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.