Threat DF.Auth.PDFODADFO.0

URI: DF.Auth.PDFODADFO.0

Description: Unauthentic data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is unauthentic, so is the forwarded flow to FlowsTo.

Threat Type: Secondary Threat

Matching Pattern:

MP-PDFODADFO

Finds a Process that receives a flow of Data from a data producer that it does not get from local storage, and forwards it towards a data store. The Process is matched twice, so it can be referred to by either role name.

DF.IS.PDFFA.8

Flow of Data from FlowsFrom to FlowsTo is in service: if process FlowsFrom is in service and able to access the data, and all the steps in the chain of processes between FlowsFrom and FlowsTo are in service, then the flow of Data from FlowsFrom to FlowsTo will be in service and potentially subject to attack, unless disabled.

P.IS.HP.8

Process Process in service: if host Host is in service, then Process running on Host will also be in service and subject to attack, unless explicitly disabled.

P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.

P.IS.HP.2

Process Process re-enabled on stolen device Host: if an attacker gains access to stolen device Host, they can restart Process, overriding the policy to disable Process.

DF.Auth.HDCDF.0

Cached flow of data Data from FlowsFrom to FlowsTo altered on Host: if the flow of Data from FlowsFrom to FlowsTo is cached on Host, and an attacker is able to tamper with the cache, the data flow will be affected. This is a secondary threat whereby changes to the cache propagate to the data flow - the attack will be what caused the cache to lose authenticity.

DF.Auth.HPDSDADF.0

Service Process serves an unauthentic stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is unauthentic, so will the flow of Data served to FlowsTo.

DF.Auth.HuWEDF.3

Phishing attack fools Human into loading malicious URL to WebBrowser: user Human viewing email in their mail client MUA clicks on a malicious link, sending it to their web browser WebBrowser.

DF.Auth.HuWESDF.3

Phishing attack fools Human feeding malicious URL to WebBrowser: user Human viewing email via webmail service MUA clicks on a malicious link, sending it to their web browser WebBrowser.

DF.Auth.HuWSMSDF.3

Smishing attack fools Human feeding malicious URL to WebBrowser: user Human clicks on a malicious link in a text message on their phone Host, sending it to their web browser WebBrowser.

DF.Auth.DScSePDmFF.3

Malicious control of Sensor alters generation of sensed output Data: if an attacker can tamper with the stored control inputs to sensor Sensor, they may be able to alter measurement of the environment by Sensor so as to deceive recipients of the data.

DF.Auth.ACDF-VFS-i.3.6

Encrypted flow of data Data to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can access its cryptographic key and alter data Data flowing between Service and FlowsTo.

DF.Auth.ACDFVFS-i.3.6

DF.Auth.ACDF-VSC-i.3.1

Flow of data Data from FlowsFrom to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can they can inject fake data via messages to Client.

DF.Auth.AC-iDF-VCS.3.2

Compromised or impersonated client Client injects fake content into the flow of data Data from FlowsFrom to FlowsTo between Client and Service: if an attacker can compromise or impersonate client Client, they can inject fake data in messages to Service.

DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

DF.Auth.AC-iDF-VSC.3.2

Imposter posing as Service injects false content into the flow of data Data from FlowsFrom to FlowsTo between Service and Client: if an attacker can impersonate service Service, they can inject false data in messages to Client.

DF.Auth.CCCSDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Service: if client Client does not send data Data to its service Service, it is still possible to inject false content into the data flow via service Service using a confused deputy attack. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).

DF.Auth.CCCSPDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not send data Data via its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.

DF.Auth.AC-iDFVFC.2.6

Client Client on stolen host CHost injects fake content into the encrypted flow of Data via Service: if an attacker has possession of host CHost and can access client Client, they can access its cryptographic key and inject malicious content into the flow of Data from Client to FlowsTo.

DF.Auth.AC-iDF-VFC.2.6

(empty)

LossOfAuthenticity at Role_OutFlow

CSG-AutoSuspendCorruptDataFlow	The flow of data *Data* from *FlowsFrom* to *FlowsTo* can be automatically disabled to prevent corrupt or malicious content (including malware) from disrupting the receipient *FlowsTo*. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-AutoSuspendCorruptDataFlow-Implementation-Runtime	The flow of data *Data* from *FlowsFrom* to *FlowsTo* has been automatically disabled to prevent corrupt or malicious content (including malware) from disrupting the receipient *FlowsTo. This strategy represents activation of a contingency plan at runtime, and can be enabled to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Activation at runtime requires FlowsTo* to be managed by a suitable adaptation framework. The Disabled Data Flow control should be deselected if and when the flow of data is enabled once again.
CSG-SuspendCorruptDataFlow	The flow of data *Data* from *FlowsFrom* to *FlowsTo* can be temporarily blocked by the manager *ProcessManager* of recipient process *FlowsTo* to prevent corrupt or malicious content (including malware) from disrupting the process. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendCorruptDataFlow-Implementation-Runtime	The flow of data *Data* from *FlowsFrom* to *FlowsTo* has been disabled by the manager *ProcessManager* of *FlowsTo* to prevent corrupt or malicious content (including malware) disrupting the process. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *ProcessManager* who is responsible for managing process *FlowsTo*. The Disabled Data Flow control should be deselected only when the flow of data is enabled again.