Changes between Version 10 and Version 11 of CachePoisonExample

Timestamp:

Nov 5, 2010 3:28:24 PM (14 years ago)

Author:

sunshine

Comment:

CachePoisonExample

@@ -9 +9 @@
 === Cache poisoning metadescription ===
 
-
+ define CachePoisoning:
  * '''Logical topology:''' 
 
@@ -57 +57 @@
   This is a special case of cache poisoning where the target is DNS cache. 
 
+define DNSCachePoisoning: import CachePoisoning cp
  * '''Logical topology:''' 
 
   '''Objects:'''
 
-    Attacker extends Node
-
     Auth extends Node
 
-    Name extends DNSName
+    (Name extends DNSName, Name := cp.Name, fakeIP extends IPAddress, FakeIP := cp.fakeResource) xor
+
+    (Name extends DNSName, domain(Name) := cp.Name, fakeAuth extends DNSName,  fakeAuth := cp.fakeResource)
 
     RealIP extends IPAddress
 
-    FakeIP extends IPAddress or fakeAuth extends DNSName
-
-    victimCache extends Object
+    victimCache extends Object, victimCache := cp.Cache
  
     victimCache := {DNSRecord[] records}
@@ -81 +80 @@
   '''Cardinality:'''
 
-    |Attacker|,,1,,
 
     |Auth|,,1,,
 
-    |Name|,,1,,
-
-    |FakeIP|,,1,,
-
-    |fakeAuth|,,1,,
-
     |RealIP|,,1,,
 
-    |victimCache|,,1,,
-
     |authCache|,,1,,
 
   '''Relationships:'''
 
-    not collocated(victimCache, Attacker)
-
     not collocated(victimCache, Auth)
  
@@ -110 +98 @@
   '''Definitions:'''
 
+    DNSREQUEST extends REQUEST
+
+    DNSREPLY extends REPLY
+
     Attacker att, Auth auth, Name n, FakeIP fIP, fakeAuth fauth, RealIP rIP, victimCache vc, authCache ac
 
@@ -120 +112 @@
       e4 := {type = DNSREPLY, origin = auth, destination = vc, content = {n=unknown}}
 
-      e5 := {type = DNSREPLY, origin = att, destination = vc, content = {auth(domain(n)) = dnsname(fakeAuth)}}
+      e5 := {type = DNSREPLY, origin = att, destination = vc, content = {auth(domain(n)) = fakeAuth}}
 
       s1 := {vc.records += (auth(domain(n)) = fakeAuth)}
@@ -130 +122 @@
   '''Timeline:'''
 
-      e1 -> e2 -> (e5 -> s1 -> e4 xor e6 -> s2 -> e3) 
+      e1 -> e2 -> (e5 | matches(e5,e2) -> s1 -> e4 xor e6 | matches(e6, e2) -> s2 -> e3) 
 
 
@@ -139 +131 @@
    The phishing attempt is essentially same as presenting a valid page to the user that asks for confidential info - it's just that the location of that page is not as user expected. 
 
+define ConfidentialAccess:
 
  * '''Logical topology:''' 
@@ -192 +185 @@
 
 Now I'm a user who wants to design an experiment. I need to combine two metadescriptions (DNS cache poisoning and phishing) and somehow tie them down to generator choices. To combine I'll do something like this:
+
+define Phishing: import DNSCachePoisoning dcp, ConfidentialAccess ca
   
-  DNSCachePoisoning dcp, confidentialAccess ca
+* '''Logical topology:''' 
+
+  '''Objects:'''
+    dcp.FakeIP := ip(ca.Server)
+
+  '''Cardinality:'''
+
+  '''Relationships:'''
+
+ * '''Timeline of events: '''
+
+  '''Definitions:'''
+
+  '''Timeline:'''
+
+      timeline(dcp) -> timeline(ca)
+ 
+
+ * '''Invariants:'''    Nothing in addition to the topology and timeline above.
+
   
-    dcp.FakeIP := ip(ca.Server)
-  
-    dcp -> ca
- 
+