Re: On classifying attacks

["Steven M. Christey" <coley () mitre org>]

Derek Martin said:

> The vulnerability is neither truly remote nor local, in the normal
> senses as we have defined them here.  It is a different kind of
> vulnerability altogether.  The vulnerability is one to automatically
> triggering trojan horses....

I agree with you on the need for a third category.

Another term could be "user-complicit," which reflects the core role
that the user has in activating the vulnerability, versus the
traditional "automatic" exploitation (no human user interaction) and
"opportunistic" exploitation (attacker has no control over when the
vulnerable state occurs, as can happen in some types of information
leaks for example).

Depending on the normal channels by which the "trojan" is delivered,
the attack could be "local user-complicit" or "remote user-complicit."
For example, images are usually shared in some remote fashion, thus a
vulnerability in an image renderer could be remote user-complicit,
whereas a vulnerability that requires a local user to trick another
local user into changing into a directory with a large name would be
local user-complicit.

One small difficulty I have with associating this too closely with the
"trojan horse" terminology is that many Trojans are inserted after a
vulnerability has been exploited and access is gained, so this further
muddies the waters of an already vague term.

- Steve