Cornucopia (C5)

The key concept is that attackers can exploit or impersonate trusted applications to deceive users and interconnected systems, leading to spoofing and unauthorized access.

Scenario: Larry's Manipulation of Trust in and Around the Application

Envision a scenario where Larry influences or abuses the trust that other parties, including users, have in a particular application, or leverages that trust to manipulate other applications. This issue arises from:

1. Exploitation of Established Trust: Larry takes advantage of the trust users or other applications have in the targeted application.
2. Cross-Application Trust Abuse: He manipulates the trust relationship between applications to perform malicious actions.

Example

Larry targets a widely used communication platform that has earned a high level of trust from its users. He creates phishing messages that appear to come from this trusted application, exploiting users' trust to gather sensitive information like login credentials. Additionally, Larry leverages this application’s API, which is trusted by other applications, to gain unauthorized access or extract data from these interconnected systems.

Threat Modeling

STRIDE

The primary STRIDE category is Spoofing.

This scenario is about exploiting trust for malicious gain, typically referred to in STRIDE as Spoofing, because Larry pretends to be the trusted application or uses its trusted identity to deceive others.

What can go wrong?

Such manipulation can lead to significant breaches of user trust, unauthorized access to sensitive information, and exploitation of interconnected systems. Abuse of trust attacks include: Clickjacking, Phishing, Pharming, SSL downgrade/misconfiguration, Session Hijacking, Cross-Site Request Forgery (CSRF) and Session Credential Falsification through Forging.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

1. Implement robust verification and authentication measures to prevent misuse of the application’s trusted status.
2. Educate users about the risks of phishing and other trust exploitation tactics.
3. Monitor and control how the application’s APIs and services interact with other systems, ensuring secure and verified connections.
4. Establish strict guidelines and security protocols for third-party applications or services that integrate with the application.
5. Implement Content Security Policy (CSP) to mitigate clickjacking and other injection attacks.
6. Use secure cookies and implement anti-CSRF tokens to protect against session hijacking and CSRF attacks.
7. Implement session management best practices, including secure session identifiers and proper session expiration.
8. Enforce digital signatures and integrity checks for tokens and limit the scope and audience of their use.
9. Harden token exchange flows, limit the lifetime of tokens and enforce cryptographic proof of possession.
10. Regularly audit and update SSL/TLS configurations to prevent downgrade attacks.
11. Employ multi-factor authentication (MFA) to enhance user account security.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.