Loading clauses/5.Requirements.md +74 −3 Original line number Diff line number Diff line Loading @@ -19,20 +19,91 @@ how does split tunneling pose a security threat relevant to this document? maybe **TODO: specific known attack vectors to apply to appropriate requirements** - Credential harvesting - Traffic hijacking - phishing - transmitting credentials in plain text - TR: don't transmit sensitive stuff in plain text - compromised devices - TR: require AV, XDR, SIEM, SOAR, etc. - TR: threat detection (traffic analysis) - connecting to masquerading server - TR: pre-shared certificates - weak encryption - TR: use strong encryption (ref existing standards) - saving traffic and decrypting later - TR: use strong encryptiong (same) - using compromised keys - TR: key rotation - TR: allow for forced key expiry - TR: provided feature to revoke keys in service - physical possession of authorized device - TR: auth timeout (periodic re-auth) - TR: require re-auth after sleep of device - TR: encrypt stored credentials and use some derived thing with a timeout (password vault kind of stuff) - TR: provided feature to revoke device - duplication of entire hard disk - TR: detect identical clients - TR: don't store credentials in secure TPM - TR: don't use reusable credentials, use passkey etc. - TR: document what the user has to do to avoid this - TR: document that this product isn't appropriate for use case or doesn't provide this thing - TR: data validation before encryption (todo) - TR: look at all the traffic generated and see if there is anything in the clear, going to the wrong place etc. - Traffic hijacking (DoS) - bad normal internet routing (DoS) - TR: include traceroute style debug info - providing wrong configuration info from masquerading servers - TR: require server certificate (TLS, etc.) (pre-shared, in configuration) - Circumventing encryption - note: two TSs in ETSI on encrypted traffic are almost done - Galina knows this, ZT-Kipling method? (sp), probably can reference this - see previous TRs - Unauthorized reads of config data - Remote code execution - TR: stored in form that can only be read with authorization - TR: do not transmit in the clear - Remote code execution (on client, server, element) - TR: mitigation: limit privileges of VPN software - TR: split into smaller pieces with lower privileges on some - TR: fuzz testing of input data? - note: secure design/devel outside scope of this part unless testable on product - DNS Leaks to local network - misconfiguration - bugs in software - bad DNS config served - TR: look at traffic - TR: configuration checks - TR: warn user??? - TR: client check DNS configuration and warn or disable? - TR: device posture thing or integrates with other tools that check configuration - TR: integrate with things that monitor traffic - Allowing untrusted traffic - allowing external traffic to route into VPN client or server - failure to exclude by application or port or endpoint - TR: policy engine allowing configure of packet filter or firewall (may be external product) - TR: validating data you are sending - TR: authentication of clients (already covered) - Traffic validity failure - FIXME: see above we think? correct if not duplicate - authentication failure - FIXME: covered above? - observation or disclosure of the user's online activity by an unauthorized and/or malicious party, including delayed disclosure - traffic analysis - leaks in general (DNS, logs on end-user device or servers, initial connection, error-related packets, partial information disclosure in packets) - see above - config error causing misrouting of traffic - utter betrayal - see above, but add specific for misrouting? - utter betrayal by the provider - note: only can work if there is a third party thing to test against - TR: third party checker/validator - TR: third party AV, etc. - unauthorized use of exit node (\*\* by service provider) - see above - unauthorised collection of PII by client - TR: examine data sent by VPN software that is "metadata" (not created by user) - unauthorised filtering or tampering of traffic (mitm) - see previous TRs - installer vulnerabilities e.g. put wrong library in path - TR: validate things needed by the installer with a hash or similar ## 5.3 [KEV] Known exploitable vulnerabilities Loading Loading
clauses/5.Requirements.md +74 −3 Original line number Diff line number Diff line Loading @@ -19,20 +19,91 @@ how does split tunneling pose a security threat relevant to this document? maybe **TODO: specific known attack vectors to apply to appropriate requirements** - Credential harvesting - Traffic hijacking - phishing - transmitting credentials in plain text - TR: don't transmit sensitive stuff in plain text - compromised devices - TR: require AV, XDR, SIEM, SOAR, etc. - TR: threat detection (traffic analysis) - connecting to masquerading server - TR: pre-shared certificates - weak encryption - TR: use strong encryption (ref existing standards) - saving traffic and decrypting later - TR: use strong encryptiong (same) - using compromised keys - TR: key rotation - TR: allow for forced key expiry - TR: provided feature to revoke keys in service - physical possession of authorized device - TR: auth timeout (periodic re-auth) - TR: require re-auth after sleep of device - TR: encrypt stored credentials and use some derived thing with a timeout (password vault kind of stuff) - TR: provided feature to revoke device - duplication of entire hard disk - TR: detect identical clients - TR: don't store credentials in secure TPM - TR: don't use reusable credentials, use passkey etc. - TR: document what the user has to do to avoid this - TR: document that this product isn't appropriate for use case or doesn't provide this thing - TR: data validation before encryption (todo) - TR: look at all the traffic generated and see if there is anything in the clear, going to the wrong place etc. - Traffic hijacking (DoS) - bad normal internet routing (DoS) - TR: include traceroute style debug info - providing wrong configuration info from masquerading servers - TR: require server certificate (TLS, etc.) (pre-shared, in configuration) - Circumventing encryption - note: two TSs in ETSI on encrypted traffic are almost done - Galina knows this, ZT-Kipling method? (sp), probably can reference this - see previous TRs - Unauthorized reads of config data - Remote code execution - TR: stored in form that can only be read with authorization - TR: do not transmit in the clear - Remote code execution (on client, server, element) - TR: mitigation: limit privileges of VPN software - TR: split into smaller pieces with lower privileges on some - TR: fuzz testing of input data? - note: secure design/devel outside scope of this part unless testable on product - DNS Leaks to local network - misconfiguration - bugs in software - bad DNS config served - TR: look at traffic - TR: configuration checks - TR: warn user??? - TR: client check DNS configuration and warn or disable? - TR: device posture thing or integrates with other tools that check configuration - TR: integrate with things that monitor traffic - Allowing untrusted traffic - allowing external traffic to route into VPN client or server - failure to exclude by application or port or endpoint - TR: policy engine allowing configure of packet filter or firewall (may be external product) - TR: validating data you are sending - TR: authentication of clients (already covered) - Traffic validity failure - FIXME: see above we think? correct if not duplicate - authentication failure - FIXME: covered above? - observation or disclosure of the user's online activity by an unauthorized and/or malicious party, including delayed disclosure - traffic analysis - leaks in general (DNS, logs on end-user device or servers, initial connection, error-related packets, partial information disclosure in packets) - see above - config error causing misrouting of traffic - utter betrayal - see above, but add specific for misrouting? - utter betrayal by the provider - note: only can work if there is a third party thing to test against - TR: third party checker/validator - TR: third party AV, etc. - unauthorized use of exit node (\*\* by service provider) - see above - unauthorised collection of PII by client - TR: examine data sent by VPN software that is "metadata" (not created by user) - unauthorised filtering or tampering of traffic (mitm) - see previous TRs - installer vulnerabilities e.g. put wrong library in path - TR: validate things needed by the installer with a hash or similar ## 5.3 [KEV] Known exploitable vulnerabilities Loading
