6

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the network, i.e. the attacker can intercept, modify and suppress every communication in the network but has no access to any of the communicating hosts. The ACTIVE ATTACK scenario of RFC 3552 seems to describe this model in an informal way.

  • By formal, do you mean "math"? – Adam Shostack Nov 30 '15 at 13:12
  • I mean math or very precise natural language. – user3998276 Nov 30 '15 at 13:22
  • There's also 7624, but I suspect that's not what you want. I think you need to clarify your question. What do these rfcs not achieve? – Adam Shostack Nov 30 '15 at 13:49
2

Formal model for an active attack

Sadly there is no way to give you a correct and unique answer.

Please read the RFC3552 you pointed out carefully:

3.3.5. Man-In-The-Middle

A MAN-IN-THE-MIDDLE attack combines the above techniques...

About which type of active or passive attacks that have to be considered:

Both techniques will probably be used (mostly by complement, one with the other) to try and get the data the attacker is after.

Depending on what you have to protect and who could be interested in parts of your data the threat model could be constantly changing even for the same attacker on your system.

Sadly this means that there really is no available attack cookbook and this is not because they are keeping this secret, but because each target and attack are different and each way the attack happens(exploit, security hole, phishing site...) are constantly different, changing, and evolving.

But from my point of view, the most vulnerable element of any securisation edifice stay human: first the user, but the programmer too!.

1

I'm not sure if I understood your question, but it sounds like you want

  1. A common threat modeling system that
  2. allows you to make distinctions between type of attacks

Are you familiar with the STIX taxonomy? You may be able to represent your "full control attacker" by creating a set of extensible Indicators and Observables and aligning it with TTPS.

http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/

Or is it more that you are looking for a common term for the idea of "attacks of an attacker with literally unlimited resources and full control over the network, i.e. the attacker can intercept, modify and suppress every communication in the network but has no access to any of the communicating hosts"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.