Skip to content

Commit 1f3ce03

Browse files
GyulyVGCGyulyVGC
committed
add THREAT_MODEL.md
1 parent 5d099cb commit 1f3ce03

3 files changed

Lines changed: 113 additions & 2 deletions

File tree

‎INCIDENT_RESPONSE.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
# Incident Response Plan
22

3-
This document describes how Sniffnet handles security incidents. <br>
4-
For how to *report* a vulnerability, see [`SECURITY.md`](https://github.com/GyulyVGC/sniffnet/blob/main/SECURITY.md).
3+
This document describes how Sniffnet handles security incidents.
4+
5+
For how to report a vulnerability, see [`SECURITY.md`](https://github.com/GyulyVGC/sniffnet/blob/main/SECURITY.md).<br>
6+
For the project's threat model, see [`THREAT_MODEL.md`](https://github.com/GyulyVGC/sniffnet/blob/main/THREAT_MODEL.md).
57

68
## Scope
79

‎SECURITY.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ as demonstrated by [security audits](https://sniffnet.net/news/security-audit/)
77

88
But no matter how much effort we put into securing the app, there can still be **vulnerabilities** present.
99

10+
For how incidents are handled, see [`INCIDENT_RESPONSE.md`](https://github.com/GyulyVGC/sniffnet/blob/main/INCIDENT_RESPONSE.md).<br>
11+
For the project's threat model, see [`THREAT_MODEL.md`](https://github.com/GyulyVGC/sniffnet/blob/main/THREAT_MODEL.md).
12+
1013
***
1114

1215
If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible.

‎THREAT_MODEL.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# Threat Model
2+
3+
This is Sniffnet's first threat model.<br>
4+
The model is intentionally scoped to a subset of the application — future iterations will expand coverage.
5+
6+
We'll use STRIDE, a widely adopted framework to help identify common types of threats:
7+
8+
- **Spoofing**: Impersonating someone or something else (e.g., faking identity).
9+
- **Tampering**: Modifying data or code (e.g., altering a file, changing network packets).
10+
- **Repudiation**: Denying an action that occurred (e.g., a user denies making a transaction).
11+
- **Information Disclosure**: Revealing sensitive data to unauthorized individuals (e.g., leaking PII, credentials).
12+
- **Denial of Service**: Preventing legitimate users from accessing a service or resource (e.g., crashing a server, exhausting resources).
13+
- **Elevation of Privilege**: Gaining unauthorized access to higher-level permissions (e.g., a regular user becoming an administrator).
14+
15+
For how to report a vulnerability, see [`SECURITY.md`](https://github.com/GyulyVGC/sniffnet/blob/main/SECURITY.md).<br>
16+
For how incidents are handled, see [`INCIDENT_RESPONSE.md`](https://github.com/GyulyVGC/sniffnet/blob/main/INCIDENT_RESPONSE.md).
17+
18+
## 1. Project overview and scope of this document
19+
20+
- **Project name:** Sniffnet
21+
- **Brief description:** Cross-platform desktop application to monitor Internet traffic.
22+
- **Key features in scope of this model:**
23+
- Packet capture and parsing from a local network adapter or imported PCAP file
24+
- User-provided files (custom MaxMind MMDB databases, IP blacklists, custom
25+
theme palettes)
26+
- Persisted and reloaded app configurations (settings, favorites, notification preferences, etc.)
27+
- Remote notifications sent to a user-configured HTTP endpoint
28+
29+
## 2. Assets to protect
30+
31+
| Asset | Why it matters |
32+
|:-----------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------|
33+
| **Host system integrity** | Sniffnet processes untrusted inputs (network traffic, user files). A vulnerability could lead to compromise of the user's system. |
34+
| **User's data privacy** | Sensitive data (including the captured traffic metadata and custom app configurations) could be exposed to a third party via a vulnerability or misconfiguration. |
35+
| **Application availability** | A crash during a monitoring session could cause loss of visibility into the user's network activity at a critical moment. |
36+
| **Project reputation** | A vulnerability that leads to compromise of user systems or data would damage trust in the project and its maintainers. |
37+
38+
## 3. Threats (STRIDE)
39+
40+
| # | Component / Flow | Spoofing | Tampering | Repudiation | Information disclosure | Denial of Service | Elevation of Privilege |
41+
|:-:|:---------------------------|:--------:|:----------:|:-----------:|:----------------------:|:-----------------:|:----------------------:|
42+
| 1 | Packet capture and parsing | — | T1 | — | I1 | D1 | E1 |
43+
| 2 | Custom MMDB file | — | T2 | — | — | — | — |
44+
| 3 | IP blacklist file | — | T3 | — | — | D3 | — |
45+
| 4 | Custom palette file | — | T4 | — | — | — | — |
46+
| 5 | App configurations file | — | T5 | — | I5 | — | — |
47+
| 6 | Remote notifications POST | S6 | — | — | I6 | — | — |
48+
49+
### Threat catalog
50+
51+
- **T1 — Malformed packet triggers parser bug.** A crafted frame on the wire
52+
reaches `LaxPacketHeaders::from_ethernet` / `from_ip` / `from_ether_type`.
53+
A logic bug in `etherparse` (or in Sniffnet's post-parse handling) could
54+
produce memory-safety issues, incorrect attribution, or panics.
55+
- **I1 — PCAP export discloses captured traffic.** When the user enables
56+
`Savefile`, captured packets — headers, hostnames, DNS queries, and
57+
payloads — are written to disk unencrypted and can be read by any
58+
local process.
59+
- **D1 — Packet flood DoS.** High packet rates or many small packets force
60+
the parser thread to fall behind; GUI freezes or memory grows unboundedly.
61+
- **E1 — Privilege escalation via parser RCE.** If T1 becomes exploitable,
62+
the attacker gets code execution inside a process holding `CAP_NET_RAW`
63+
(Linux) or Npcap driver access (Windows). There is no privilege drop
64+
after capture handle creation.
65+
- **T2 — Malicious MMDB.** A crafted `.mmdb` targets the `maxminddb` reader
66+
(tree traversal, decoder). `open_readfile` memory-maps the file, so
67+
parser bugs touch privileged memory.
68+
- **T3 — Blacklist tampering.** Another process running as the user can
69+
edit the file loaded by `IpBlacklist::from_file` to remove entries for
70+
known-bad IPs (suppressing alerts) or add benign IPs (driving false
71+
positives). There is no signature, checksum, or integrity check on the
72+
blacklist contents.
73+
- **D3 — Huge blacklist file.** `IpBlacklist::from_file` loads the whole
74+
file into memory via `tokio::fs::read_to_string` — no streaming, no size
75+
cap. A multi-GB file would exhaust memory.
76+
- **T4 — Palette tampering.** `Palette::from_file` accepts any well-formed
77+
hex color without semantic validation. A tampered TOML can set alert
78+
colors to be indistinguishable from normal-traffic colors, or render
79+
the UI illegibly, causing the user to miss or misattribute
80+
security-relevant GUI state.
81+
- **T5 — Config tampering.** Another process running as the user can edit
82+
`conf.toml` to insert a malicious MMDB path, blacklist path, palette
83+
path, or remote webhook URL. On next launch Sniffnet trusts these paths.
84+
- **I5 — Config discloses watch list.** Favorites, custom
85+
file paths, and the webhook URL can be read by any local process.
86+
- **S6 — Webhook impersonation.** A tampered `conf.toml` redirects
87+
notifications to an attacker's server while the user still believes
88+
they're sending to their own bot / SIEM. The JSON body
89+
(`LoggedNotification::to_json`) contains host info, service, favorite
90+
metadata, and byte counts — i.e., the user's own network activity.
91+
- **I6 — Webhook body discloses monitored assets.** The JSON emitted by
92+
`LoggedNotification::to_json` includes favorited host country / ASN /
93+
domain and, for blacklist hits, the malicious IP, its reverse-resolved
94+
domain, and byte counts. A compromised webhook endpoint — or an
95+
on-path observer if the URL is plaintext — learns which assets the
96+
user watches and which security events have fired.
97+
98+
## 4. Mitigations
99+
100+
| # | Threat | Mitigation | Status |
101+
|:---:|:-------------|:----------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------|
102+
| M1 | T1 / E1 / T2 | Keep `etherparse`, `pcap`, and `maxminddb` on the latest patched versions. | Active — Dependabot monitors Cargo manifests. |
103+
| M2 | T1 / E1 | Add fuzz targets for the packet ingestion entry points (`from_ethernet`, `from_null`, `from_linux_sll`) using `cargo-fuzz`. | Not implemented. |
104+
| M3 | D1 | Bound the pcap channel / parsing queue and drop oldest rather than growing memory unboundedly. | Needs review of `pcap_tx` backpressure. |
105+
| M4 | D3 | Cap the blacklist file size (e.g. 10 MB) before `read_to_string`. | Not implemented. |
106+
| M5 | I6 | Reject non-`https://` webhook URLs in the settings UI. | Not implemented. |

0 commit comments

Comments
 (0)