Repository navigation
Quick security audit #60
Description
Activity
What value can an attacker obtain from attacking pheromon? How?
Sensors long/lat are public infos, no value.
Might take control of a sensor to do something else (botnet, etc.). This can happen via theopentunnelcommand and providing some IP address. Might be solved via removing the argument (or allowing a whitelist only). Create another issue on this topic.What value do we lose if pheromon is being attacked? How?
Data loss. Via malicious sensor deletion (CASCADE DELETE).
Service unavailable (DoS) => citizen.ants.builders useless.
Take control of sensors (and we have to go to every recycling center to replace/reboot them)
People can create fake sensors (Token with sensors is shared in full text currently)
People cannot simulate fake sensors measurements (need the token)Mucus surface
- HTTP API (web). Some parts with token, some others open "open data" style
Websocket for real time (web). For Admin, some commands (forward AT commands to sensor, create sensors) use web socket. Can this be used from any malicious web server? - MQTT (sensors)
- HTTP API (web). Some parts with token, some others open "open data" style
Mucus surface in the code
https://github.com/anthill/pheromon/blob/master/api/api.js
=> web (html, css, js, etc.) routes.https://github.com/anthill/pheromon/blob/master/api/routes.js
=> web/data routes. Lots of POST and DELETE to be carefully reviewed.
Add a test for each route which should fail if a token is missing to make sure we're not letting things slip though by mistake.https://github.com/anthill/pheromon/blob/master/broker/makeMqttServer.js
=> MQTT events (are there others?). I'm too unfamiliar with MQTT to assess it. Who can access what? who can send which message to whom?The discussion of whether a sensor can access the server has come up several times. The answer seems to be no, but the fact we're asking the question often means this means to be carefully documented. Maybe with a picture (sequence diagram).
I tried to address some of this in #61 about the api part.
The mqtt part is ok from what I think.
@DavidBruant could you have a look ?What's the state of this issue today ?
Blargh, putting in prod tomorrow. Let's take a quick look at various security features of the project.
First off, let's do some threat modeling in 2 categories:
Most important question:
What is pheromon's mucus surface? How can people harm pheromon and/or Ants from abusing this surface?
Then... dunno, let's see what we'll find and figure things out.