mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
UNITRONIX
107 lines
5.3 KiB
Markdown
107 lines
5.3 KiB
Markdown
# BetterDesk — Threat Model
|
|
|
|
> **Methodology:** STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
|
|
> **Last Updated:** 2026-04-01
|
|
> **Scope:** BetterDesk Go Server, Node.js Console, Desktop Client, CDAP Agent
|
|
|
|
---
|
|
|
|
## System Overview
|
|
|
|
```
|
|
Internet / WAN
|
|
|
|
|
+----------------+----------------+
|
|
| | |
|
|
RustDesk Client Web Browser CDAP Agent
|
|
| | |
|
|
[Signal TCP/UDP] [HTTPS :5000] [WSS :21122]
|
|
[Relay TCP/WS] [API :21121] |
|
|
| | |
|
|
+----+----+ +-----+-----+ +----+----+
|
|
| Go Server| | Node.js | | Go Server|
|
|
| :21114-19| | Console | | CDAP GW |
|
|
+----+----+ +-----+-----+ +----+----+
|
|
| | |
|
|
+--------+-------+-------+--------+
|
|
| |
|
|
[SQLite/PG] [auth.db]
|
|
```
|
|
|
|
## STRIDE Analysis
|
|
|
|
### S — Spoofing
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| Device ID spoofing | Signal server | Ed25519 public key verification on registration | ✅ Done |
|
|
| Admin impersonation | Web console | bcrypt password hashing + TOTP 2FA | ✅ Done |
|
|
| API key theft | Go server API | Key stored in file with 0600 permissions, auto-regenerated | ✅ Done |
|
|
| Org user impersonation | Org system | PBKDF2/bcrypt password hashing + JWT with short TTL | ✅ Done |
|
|
| Relay UUID spoofing | Relay server | Server-generated UUIDs, pending UUID tracking map | ✅ Done |
|
|
|
|
### T — Tampering
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| Message modification in transit | Signal/Relay | NaCl authenticated encryption (XSalsa20-Poly1305) | ✅ Done |
|
|
| Database tampering | SQLite/PG | File permissions, PostgreSQL row-level locking | ✅ Done |
|
|
| Config file tampering | Client | Organization policy enforcement on startup | 🔲 Phase 4 |
|
|
| Audit log tampering | Go server | Ring-buffer audit log | ⚠️ Add HMAC chain |
|
|
|
|
### R — Repudiation
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| Deny remote session | Web console | Audit log with connection start/end, operator ID, device ID | ✅ Done |
|
|
| Deny admin actions | Web console | Audit log for login, config changes, device operations | ✅ Done |
|
|
| Deny file transfer | Client | Session recording planned | 🔲 Phase 3 |
|
|
|
|
### I — Information Disclosure
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| Private key exposure | Go server | Ed25519 keys in separate directory, 0600 permissions | ✅ Done |
|
|
| Password in logs | All | Passwords never logged, masked in error messages | ✅ Done |
|
|
| API key in URL | Node.js | Keys sent via X-API-Key header, never in URL params | ✅ Done |
|
|
| Error stack traces | Node.js | Production mode hides stack traces from HTTP responses | ✅ Done |
|
|
| Database path disclosure | Go server | Generic error messages for DB failures | ✅ Done |
|
|
|
|
### D — Denial of Service
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| TCP connection flood | Signal server | Per-IP rate limiting, connection cap (10K) | ✅ Done |
|
|
| Login brute force | Go server API | IP-based rate limiter on /api/auth/login | ✅ Done |
|
|
| Relay stale sessions | Relay server | Idle timeout wrapper (io.Copy), 2-min TTL | ✅ Done |
|
|
| WebSocket exhaustion | Signal/Relay WS | Origin validation, connection limits | ✅ Done |
|
|
| Large request body | Node.js | Express body parser limit (2MB / 64KB for WAN API) | ✅ Done |
|
|
|
|
### E — Elevation of Privilege
|
|
|
|
| Threat | Component | Mitigation | Status |
|
|
|--------|-----------|------------|--------|
|
|
| Operator → Admin escalation | Web console | Role-based middleware (requireAdmin, requireRole) | ✅ Done |
|
|
| User → Operator escalation | Org system | JWT claims include role, verified on every request | ✅ Done |
|
|
| Banned device reconnect | Signal server | IsPeerBanned + IsPeerSoftDeleted checks | ✅ Done |
|
|
| SQL injection | All DB queries | Parameterized queries throughout, LIKE escape for wildcards | ✅ Done |
|
|
|
|
## Trust Boundaries
|
|
|
|
1. **Internet ↔ Go Server** — TLS required for production (`--tls-signal`, `--tls-relay`)
|
|
2. **Browser ↔ Node.js Console** — HTTPS recommended, session cookies with Secure/HttpOnly/SameSite
|
|
3. **Node.js Console ↔ Go Server API** — Localhost HTTP with API key (mTLS planned)
|
|
4. **Desktop Client ↔ Signal Server** — NaCl key exchange, then encrypted channel
|
|
5. **Peer ↔ Peer (P2P)** — NaCl box encryption (X25519 + XSalsa20-Poly1305)
|
|
6. **CDAP Agent ↔ Gateway** — WebSocket with API key authentication
|
|
|
|
## Open Risks
|
|
|
|
| Risk | Severity | Planned Mitigation |
|
|
|------|----------|-------------------|
|
|
| Console ↔ Go Server uses plain HTTP | Medium | mTLS or Unix socket (Phase 8) |
|
|
| No API key rotation mechanism | Medium | Auto-rotation with grace period (Phase 8) |
|
|
| Audit log not tamper-proof | Low | HMAC chain signing (Phase 8) |
|
|
| No certificate pinning in client | Medium | Pin server certificate in Tauri (Phase 8) |
|
|
| Credentials not zeroized in memory | Low | Use zeroize crate for Rust, explicit clearing for Node.js (Phase 8) |
|