pytm

The DS02 Try All Common Switches threat occurs when an attacker blindly attempts to invoke various command-line switches or options (like --debug) to discover weaknesses or unpublicized functionality.

To trigger this threat in your model, the target must satisfy the following condition:

• target.environment is 'Production'

The INP09 LDAP Injection threat occurs when an attacker manipulates or crafts an LDAP query to undermine security, similar to SQL injection.

To trigger this threat in your model, the target must satisfy the following condition:

• target.controls.validatesInput is False

The pytm threat database uses specific boolean conditions to automatically identify threats within a model. When defining components or controls in your threat model, setting certain attributes will trigger the inclusion of specific threats.

Common condition patterns include:

• target.controls.implementsAuthenticationScheme is False: Triggers threats like CR03 Dictionary-based Password Attack.
• target.implementsAPI is True and target.controls.validatesInput is False: Triggers threats like API02 Exploit Script-Based APIs.
• target.hasPhysicalAccess is True: Triggers threats like HA02 White Box Reverse Engineering.
• target.controls.isHardened is False: Triggers threats like DS03 Footprinting.

The threat AC24 Use of hardcoded credentials is triggered when credentials (passwords or certificates) are hardcoded into the system, making them impossible to change without code modifications.

Condition Logic: An alert is raised if:

1. The target contains any data marked as isCredentials.
2. The target's sink is inScope.
3. AND any credential data has a credentialsLife set to Lifetime.HARDCODED.

In pytm, threats are automatically identified based on specific conditions met by your model's components (targets, controls, and data). When defining your threat model, you can trigger specific threats from the database by ensuring your Control objects have the appropriate attributes set.

Common attributes used to satisfy threat conditions include:

• validatesInput: Boolean indicating if input is validated.
• sanitizesInput: Boolean indicating if input is sanitized.
• checksInputBounds: Boolean indicating if input length/bounds are checked.
• authorizesSource: Boolean indicating if the source of data is authorized.

For example, to avoid a Relative Path Traversal threat, you must ensure that your target's controls have both validatesInput and sanitizesInput set to True.

The AC03 Subverting Environment Variable Values threat occurs when an attacker modifies environment variables to cause software to deviate from expected operation.

To trigger this threat in your model, the target must satisfy the following condition:

• target.usesEnvironmentVariables is True
• AND at least one of the following is False:
  • target.controls.implementsAuthenticationScheme
  • target.controls.validatesInput
  • target.controls.authorizesSource

The INP08 Format String Injection threat occurs when an adversary includes formatting characters (e.g., %s, %n) in string input, potentially allowing them to read or write to memory.

To trigger this threat in your model, the target must satisfy the following condition:

• target.controls.validatesInput is False
• OR target.controls.sanitizesInput is False

The threat AC22 Credentials Aging is triggered when there is no mechanism for managing the expiration of passwords or certificates.

Condition Logic: An alert is raised if:

1. The target contains any data marked as isCredentials.
2. The target's sink is inScope.
3. AND any credential data has a credentialsLife set to Lifetime.UNKNOWN, Lifetime.LONG, Lifetime.MANUAL, or Lifetime.HARDCODED.

When using the reveal.md template, findings are injected into components (Actors, Trust Boundaries, Assets, and Data Flows) using a specific templating pattern. This ensures that security vulnerabilities or threats are directly linked to the architectural element they affect.

To display findings for a component, the template uses a conditional loop: {{item:call:getInScopeFindings: ... }}. Inside this loop, the following methods are used to extract finding details:

• {{item:call:getThreatId}}: The unique identifier for the threat.
• {{item:call:getFindingDescription}}: A description of the finding.
• {{item:call:getFindingTarget}}: The specific element targeted by the threat.
• {{item:call:getFindingSeverity}}: The severity level of the finding.
• {{item:call:getFindingReferences}}: References or links related to the threat.

The threat AC23 Credentials Disclosure is triggered when credentials with long lifetimes are at risk of being disclosed without a quick way to rotate them.

Condition Logic: An alert is raised if:

1. The target contains any data marked as isCredentials.
2. The target's sink is inScope.
3. AND any credential data has a credentialsLife set to Lifetime.UNKNOWN, Lifetime.LONG, or Lifetime.MANUAL.

The DO02 Excessive Allocation threat occurs when an adversary causes the target to allocate excessive resources (memory, bandwidth, etc.), leading to service degradation or denial of service.

To trigger this threat in your model, the target must satisfy the following condition:

• target.controls.handlesResourceConsumption is False

The threat DR01 Unprotected Sensitive Data is triggered when sensitive data (PII or Credentials) is not sufficiently protected during transit or at rest.

Condition Logic: An alert is raised if:

1. The target has data leaks OR contains data marked as isCredentials or isPII.
2. AND one of the following is true:
   • The target's controls are not encrypted (not target.controls.isEncrypted).
   • The target is not a response and contains stored data that is not encrypted at rest (not target.isResponse and any(d.isStored and d.isDestEncryptedAtRest for d in target.data)).
   • The target is a response and contains stored data that is not encrypted at rest (target.isResponse and any(d.isStored and d.isSourceEncryptedAtRest for d in target.data)).