Attack patterns

In computer science, attack patterns are a group of rigorous methods for finding bugs or errors in code.

General Definition

Attack patterns are much like standard development patterns, in that they define a series of repeatable steps that can be applied to simulate an attack against the security of a system. From the development life cycle viewpoint, there are two categories of attack patterns: architectural and physical.

Architectural attack patterns are used to attack flaws in the architectural design of the system. These are things like weaknesses in protocols, authentication strategies, and system modularization. These are more logic-based attacks than actual bit-manipulation attacks.

In contrast, physical attack patterns are targeted at the code itself. These are things such as SQL injection attacks, buffer overflows, race conditions, and some of the more common forms of attacks that have become popular in the news and with so-termed script kiddies.

There is also a third category of attack pattern which encompasses such things as trojan horse attacks, viruses, and worms. These are not generally solvable by software-design approaches, because they operate relatively independently from the attacked program. However, vulnerabilities in a piece of software can lead to these attacks being successful on a system running the vulnerable code. An example of this is the vulnerable edition of Microsoft SQL Server, which allowed the Slammer worm to propagate itself.[1] The approach taken to these attacks is generally to revise the vulnerable code.

Attack patterns are often used for testing purposes, but are also very important for ensuring that potential vulnerabilities are prevented. The attack patterns themselves can be used to highlight areas which need to be considered for security hardening in a software application. They also provide, either physically or in reference, the common solution pattern for preventing the vulnerability. Such a practice can be termed as defensive coding patterns.

Pattern Structure

Existing Pattern Structures

An example of a standardised way for describing patterns is the way they are presented in Design Patterns (Gamma, Helm, Johnson, Vlissides) [2] . They proposed that a pattern has four essential elements. The Pattern Name, The Problem, the Solution, and The Consequences (p. 3). This basic makeup is then further expanded for representation. The common representation they used is listed here(p.6):

• Pattern name and Classification
• Intent
• Also Known As
• Motivation
• Applicability
• Structure
• Participants
• Collaborations
• Consequences
• Implementation
• Sample Code
• Known Uses
• Related patterns

Martin Fowler in his representations is a bit more generalised as far as the structure goes. His pattern representation consists of

• Pattern Name
• Description
• Also Known As
• ‘How It Works’
• ‘When To Use It’

Example

A sample of this layout can be found at: [3]

When considering an attack pattern, the first example above is closer to what we would think of when considering how to represent an attack. Many of the items such as intent, motivation, applicability, and consequences are very relevant to security related patterns. Therefore, we will base our pattern structure on the one presented in Design Patterns (as referenced above) with necessary modifications to suite the purpose.

Attack Pattern Structure

In order to accurately and succinctly describe an attack pattern, we must have a consistent and easily consumable way of representing the patter to the user. Therefore we want to try and stay close to existing pattern representations that exist in the industry and add the necessary information to ensure we convey the pattern properly.

The structure for recording Attack Patterns is as follows:

Pattern Name Type & Subtypes Also Known As Description Attacker Intent Motivation Exploitable Vulnerability Participants Process Diagram Dependencies and Conditions Sample Attack Code Existing Exploits Folow-On Attacks Mitigation Types Recommended Mitigation Related Patterns Related Alerts, Listings and Publications

These sections are described in detail below.

Pattern Name

The Pattern Name is essentially the label given to the pattern which is commonly used to refer to the pattern in question. The Name portion is fairly self-explanatory.

Types & Subtypes, Automatable

The pattern type and its associated subtypes aid in classification of the pattern. This allows users to rapidly locate and identify pattern groups that they will have to deal with in their security efforts.

Each pattern will have a type, and zero or more subtypes that identify the category of the attack pattern. Typical types include Injection Attack, Denial of Service Attack, Cryptanalysis Attack, etc. Examples of typical subtypes for Denial Of Service for example would be: DOS – Resource Starvation, DOS-System Crash, DOS-Policy Abuse.

Another important use of this field is to ensure that true patterns are not repeated unnecessarily. Often it is easy to confuse a new exploit with a new attack. New exploits are created all the time for the same attack patterns. The Buffer Overflow Attack Pattern is a good example. There are many known exploits, and viruses that take advantage of a Buffer Overflow vulnerability. But they all follow the same pattern. Therefore the Type and Subtype classification mechanism provides a way to classify a pattern. If the pattern you are creating doesn’t have a unique Type and Subtype, chances are it’s a new exploit for an existing pattern.

This section is also used to indicate if it is possible to automate the attack. If it is possible to automate the attack, it is recommended to provide a sample in the Sample Attack Code section which is described below.

Also Known As

Certain attacks may be known by several different names. This field is used to list those other names.

Description

This is a description of the attack itself, and where it may have originated from. It is essentially a free-form field that can be used to record information that doesn’t easily fit into the other fields.

Attacker Intent and Results

This field identifies the intended result of the attacker. This indicates the attacker’s main target and goal for the attack itself. For example, The Attacker Intent of a DOS – Bandwidth Starvation attack is to make the target web site unreachable to legitimate traffic.

Motivation

This field records the attacker’s reason for attempting this attack. It may be to crash a system in order to cause financial harm to the organisation, or it may be to execute the theft of critical data in order to create financial gain for the attacker.

This field is slightly different than the Attacker Intent field in that it describes why the attacker may want to achieve the Intent listed in the Attacker Intent field, rather than the physical result of the attack.

Exploitable Vulnerability

This field indicates the specific or type of vulnerability that creates the attack opportunity in the first place. An example of this in an Integer Overflow attack would be that the integer based input field is not checking size of the value of the incoming data to ensure that the target variable is capable of managing the incoming value. This is the vulnerability that the associated exploit will take advantage of in order to carry out the attack.

Participants

The Participants are one or more entities that are required for this attack to succeed. This includes the victim systems as well as the attacker and the attacker’s tools or system components. The name of the entity should be accompanied by a brief description of their role in the attack and how they interact with each other.

Process Diagram

These are one or more diagrams of the attack to visually explain how the attack is executed. This diagram can take whatever form is appropriate but it is recommended that the diagram be similar to a system or class diagram showing data flows and the components involved.

Dependencies and Conditions

Every attack must have some context to operate in and the conditions that make the attack possible. This section describes what conditions are required and what other systems or situations need to be in place in order for the attack to succeed. For example, for the attacker to be able to execute an Integer Overflow attack, they must have access to the vulnerable application. That will be common amongst most of the attacks. However if the vulnerability only exposes itself when the target is running on a remote RPC server, that would also be a condition that would be noted here.

Sample Attack Code

If it is possible to demonstrate the exploit code, this section provides a location to store the demonstration code. In some cases, such as a Denial of Service attack, specific code may not be possible. However in Overflow, and Cross Site Scripting type attacks, sample code would be very useful.

Existing Exploits

Exploits can be automated or manual. Automated exploits are often found as viruses, worms and hacking tools. If there are any existing exploits known for the attack this section should be used to list a reference to those exploits. These references can be internal such as corporate knowledge bases, or external such as the various CERT, and Virus databases.

Exploits are not to be confused with vulnerabilities. An Exploit is an automated or manual attack that utilises the vulnerability. It is not a listing of a vulnerability found in a particular product for example.

Follow-On Attacks

Follow-on attacks are any other attacks that may be enabled by this particular attack pattern. For example, a Buffer Overflow attack pattern, is usually followed by Escalation of Privilege attacks, Subversion attacks or setting up for Trojan Horse / Backdoor attacks. This field can be particularly useful when researching an attack and identifying what other potential attacks may have been carried out or set up.

Mitigation Types

The mitigation types are the basic types of mitigation strategies that would be used to prevent the attack pattern. This would commonly refer to Security Patterns and Defensive Coding Patterns. Mitigation Types can also be used as a means of classifying various attack patterns. By classifying Attack Patterns in this manner, libraries can be developed to implement particular mitigation types which can then be used to mitigate entire classes of Attack Patterns. This libraries can then be used and reused throughout various applications to ensure consistent and reliable coverage against particular types of attacks.

Recommended Mitigation

Since this is an attack pattern, the recommended mitigation for the attack can be listed here in brief. Ideally this will point the user to a more thorough mitigation pattern for this class of attack.

Related Patterns

This section will have a few subsections such as Related Patterns, Mitigation Patterns, Security Patterns, and Architectural Patterns. These are references to patterns that can support, relate to or mitigate the attack and the listing for the related pattern should note that.

An example of related patterns for an Integer Overflow Attack Pattern is:

Mitigation Patterns – Filtered Input Pattern, Self Defending Properties pattern

Related Patterns – Buffer Overflow Pattern

Related Alerts, Listings, and Publications

This section lists all the references to related alerts listings and publications such as listings in the Common Vulnerabilities and Exposures list, CERT, SANS, and any related vendor alerts. These listings should be hyperlinked to the online alerts and listings in order to ensure it references the most up to date information possible.

CVE: [4]

CWE: [5]

CERT: [6]

Various Vendor Notification Sites.

Researchers

There are two notable researchers into this area at the moment.

Rocky Heckman [7]

Contributions at: [8], [9], and [10]

and

Cigital Corp [11]

Contributions at: [12]

Reference material on Software Security and Patterns

Alexander, Christopher; Ishikawa, Sara; & Silverstein, Murray. A Pattern Language. New York, NY: Oxford University Press, 1977

Gamma, E.; Helm, R.; Johnson, R.; & Vlissides, J. Design Patterns: Elements of Reusable Object-Oriented Software ISBN 0201633612, Addison-Wesley, 1995

Thompson, Herbert; Chase, Scott, The Software Vulnerability Guide ISBN 1584503580, Charles River Media, 2005

Gegick, Michael & Williams, Laurie. “Matching Attack Patterns to Security Vulnerabilities in Software-Intensive System Designs.” ACM SIGSOFT Software Engineering Notes, Proceedings of the 2005 workshop on Software engineering for secure systems—building trustworthy applications SESS '05, Volume 30, Issue 4, ACM Press, 2005

Howard, M.; & LeBlanc, D. Writing Secure Code ISBN 0735617228, Microsoft Press, 2002.

Moore, A. P.; Ellison, R. J.; & Linger, R. C. Attack Modeling for Information Security and Survivability, Software Engineering Institute, Carnegie Mellon University, 2001

Hoglund, Greg & McGraw, Gary. Exploiting Software: How to Break Code ISBN 0201786958, Addison-Wesley, 2004

McGraw, Gary. Software Security: Building Security In ISBN 0321356705, Addison-Wesley, 2006

Viega, John & McGraw, Gary. Building Secure Software: How to Avoid Security Problems the Right Way ISBN 020172152X, Addison-Wesley, 2001

Schumacher, Markus; Fernandez-Buglioni, Eduardo; Hybertson, Duane; Buschmann, Frank; Sommerlad, Peter Security Patterns ISBN 0470858842, John Wiley & Sons, 2006

Koizol, Jack; Litchfield, D.; Aitel, D.; Anley, C.; Eren, S.; Mehta, N.; & Riley. H. The Shellcoder's Handbook: Discovering and Exploiting Security Holes ISBN 0764544683, Wiley, 2004

Schneier, Bruce. Attack Trees: Modeling Security Threats Dr. Dobb’s Journal, December, 1999