Cornucopia (C4)

The key concept is that insufficient logging and user identification can enable untraceable actions, allowing attackers to deny responsibility and evade accountability.

Scenario: Keith’s Untraceable Actions in the Application

Imagine a scenario where Keith can perform actions within an application, but it’s impossible to attribute these actions to him. This lack of traceability arises from:

1. Inadequate User Activity Logging: The application does not maintain comprehensive logs of user activities.
2. Lack of User Identification in Actions: Actions performed within the application are not linked to specific user identities.
3. Insufficient Audit Trails: The system lacks robust audit trails that record detailed information about user actions.

Example

Keith exploits a financial application that lacks proper logging mechanisms. He conducts unauthorized transactions, but the system does not record detailed logs of user activities or link these actions to individual user accounts. Consequently, there’s no trace of Keith’s activities in the application’s logs, making it difficult to identify him as the perpetrator or to understand the sequence of actions he performed.

Threat Modeling

STRIDE

The applicable STRIDE category here is Repudiation.

Repudiation occurs when a user can perform actions without leaving verifiable evidence, meaning the system cannot prove who performed the action. In this scenario, Keith conducts unauthorized transactions, and the lack of proper logging prevents attribution, so he can deny responsibility. STRIDE’s Repudiation threat focuses on the inability to trace or hold users accountable for their actions.

What can go wrong?

This vulnerability can lead to unauthorized actions going unnoticed, hinder incident response efforts, and impede accountability, potentially resulting in financial losses and security breaches.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

1. Implement comprehensive logging of all user activities within the application, capturing details such as timestamps, user IDs, and the nature of the actions.
2. Ensure that all actions are attributable to individual users by maintaining secure and unique user identification mechanisms.
3. Develop robust audit trails that provide a clear and detailed history of user actions for accountability and forensic analysis.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.