300-NetBSD-RelEng-STRIDE

1 files changed, 96 insertions, 0 deletions

diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.puml
new file mode 100644
index 0000000..5de5cbe
--- /dev/null
+++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.puml
@@ -0,0 +1,96 @@
+@startuml
+ ' keine farben!!
+' !theme mimeograph
+
+skinparam shadowing false
+skinparam rectangle { 
+	BorderThickness 2 
+}
+
+Title Attack Flow and Trust Boundaries: manipulated ISO image AND manipulated checksums/signatures (SLSA1)
+
+header
+= Attack Flows and Trust Boundaries
+Timestamp: %date("yyyy-MM-dd kk:mm Z") 
+endheader
+
+legend right
+|= STRIDE |= Abbrevation|
+|S| Spoofing |
+|T| Tampering |
+|R| Repudiation |
+|I| Information Disclosure |
+|DoS| Denial of Service |
+|EoP| Elevation of Privilege |
+
+Relationship Colour
+|= Colour |= Attack Phase|
+|<#ff0000> Red| Initial Exploit |
+|<#800080> Deep Purple| Lateral Movement |
+|<#ffa500> Orange| Integrity Violation |
+|<#008000> Green| Legitimate Signing |
+
+LightGray box: Trust Boundary
+Notes on Relation: STRIDE category
+DF: Data Flow
+AT: Attack Path
+endlegend
+
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+
+rectangle "Internet" #line:LightGray {
+  actor "<color:red>Black Hat</color>"" as Attacker #FF0000
+} 
+
+rectangle "DMZ" #line:LightGray {
+  rectangle "Public Web Server:" as WWW
+  	note right of WWW : T, I, DoS, EoP
+}
+
+rectangle "Internal Network" #line:LightGray {
+  rectangle "CVS RelEng" as BS
+  	note right of BS : T, R, EoP 
+  	database "Release Repo <color:red>HVT</color>" as Repo
+	note right of Repo :   S, T, R, I, DoS, EoP
+  actor "Security Officer" #00ff00
+}
+
+
+
+
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+
+BS --> Repo : (DF1) Publish ISO + Checksums
+"Security Officer" -[#green,thickness=2]-> Repo : (DF2) Sign Checksums (GnuPG)
+Repo --> WWW : (DF3) Deploy Artifacts
+WWW --> Attacker : (DF4) Distribute ISO + Checksums + Signature
+
+
+
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Attacker -[#red,dashed]-> WWW : (AT1) Exploit Webserver Vuln
+note on link: EoP 
+
+WWW -[#purple,dashed]-> Repo : (AT2) Pivot to Repo
+note on link: EoP [#Orange]
+
+Repo -[#orange,dashed,thickness=2]-> Repo : (AT3) Replace ISO\n&& Checksum\n&& Signature
+note on link: Tamper
+
+' Repo -[#orange,dashed]-> Repo : (AT4) Modify Checksums\n
+' note on link: Tamper
+' 
+' Repo -[#orange,dashed]-> Repo : (AT5) Replace GPG Signature\n
+' note on link: Tamper
+
+
+
+
+@enduml