Copyright © 2009 Open Geospatial Consortium, Inc. 89
Scope No application specific knowledge required.
Example Likelihood
High Impact on Asset
None Impact on User
None Reason
Espionage and preparation for further attacks. Requirement
Confidentiality
Table 92: Record Advertise requestresponse
9.7.3 RenewAdvertisement operation
Asset: Alert Subscription Offerings
Cause Man-In-The-Middle
Effect Actual SAS will delete existing offering after regular expiration as no renewal was
received. Result
Sensors will send data longer than SAS offering exists. Subscribed clients will still receive alerts via the XMPP channel, as this
communication is not effected by the attack. New subscriptions will not take place as the SAS will not provide that offering
longer as originally assured by the sensor in the previous Advertise message. Scope
Application specific knowledge required. Example
Likelihood Medium
Impact on Asset Direct affect on asset.
Impact on User Impact on all users as the renewal request will not be received by the actual SAS.
Potential NA
Reason Sabotage
Requirement SAS authentication and authenticity on the response to allow the client determine
that the response came from another service.
90 Copyright © 2009 Open Geospatial Consortium, Inc.
Table 93: Redirect RenewAdvertisement request
Cause Man-In-The-Middle
Effect SAS will receive fraudulent RenewAdvertisement request.
Result Two extremes are likely: The renewal date until the sensor will send data can
i be very short. This is comparable to the ―redirect‖ attack if the renewal
time is extremely close to the current time. The sensor will continue sending data even though the SAS will delete the offering in the very
near future.
ii be pushed into the invite future. The offering in the SAS will then exist
forever, but the sensor will stop sending data at the originally posted renewal date.
Scope Application specific knowledge required.
Example Attacker changes the RenewAdvertisement for ID 4711 to end on April 1, 2009 to
December 1, 2009. As the SAS returns to the client only ―4711 confirmed‖ and not that the date has erroneously been changed to Dec 1, 2009, the sensor is in the
impression that everything went O.K., which is actually wrong So perhaps at April 1, 2009 the sensor will stop sending data, as it reported to the SAS earlier. But the
SAS will keep the offering up until December 1, 2009 not knowing that there will be no more data coming in.
Likelihood Medium
Impact on Asset Direct affect on asset.
Impact on User Impact on all usres as the actual renewal request is tampered before received by the
SAS. Potential
NA Reason
Sabotage Requirement
Integrity
Table 94: Modify RenewAdvertisement request
Cause Adversary’s client can execute SAS.
Effect SAS will receive fictitious RenewAdvertisement request.
Result If the PublicationID of a fictitious RenewAdvertisement message matches an
existing offering, the SAS would change it accordingly, similar to the ―change‖
attack. Unnoticeable for user clients with existing subscriptions but effective for new subscriptions.
Copyright © 2009 Open Geospatial Consortium, Inc. 91
Scope Application specific knowledge is required.
Example Likelihood
Low Impact on Asset
Direct affect on asset. Impact on User
Impact on all users that will receive the advertisement. Potential
NA Reason
Sabotage Requirement
Access Control to allow only advertisement owners to apply this operation.
Table 95: Create RenewAdvertisement request
Cause Eavesdropping and adversary’s client can execute SAS.
Effect SAS will receive old renewal requests.
Result RenewalAdvertisement request for existing offering that have been processed in
the meantime become effect less. If a replayed RenewalAdvertisement request is received for which the SAS
received a CancelAdvertisement request earlier, the response will be an Exception. Scope
No application specific knowledge required. Example
Adversary records a RenewAdvertisement message that instructs the SAS to change the date on offering 4711 until February 1, 2009. By the end of January, the
sensor will renew 4711 until April 1, 2009. If the adversary re-sends the recorded message, the SAS will change the end of the advertisement back to February 1,
2009.
Likelihood High
Impact on Asset Direct affect on asset.
Impact on User Impact on all users as the replayed request overwrites other related requests issued
in the meantime. Potential
NA Reason
Sabotage Requirement
Unique request id and time stamp to detect replay.
Table 96: Replay RenewAdvertisement request
92 Copyright © 2009 Open Geospatial Consortium, Inc.
Cause Man-In-The-Middle
Effect Sensor will receive fraudulent response that does not reflect the result of the
processing done by the SAS. Result
Advertisements that have resulted in a processing error will not be available as offerings. But the sensor does not know that as the status might have set to
―confirmed‖ by the attack. Scope
Application specific knowledge is required. Example
Likelihood Medium
Impact on Asset Leads to potentially invalid offerings no data production
Impact on User Impact on the client if the response is modified from success to failure This would
cause the user to re-initiate the RenewAdvertisement over and over again. Potential
NA Reason
Sabotage Requirement
Integrity
Table 97: Modify RenewAdvertisement response
9.7.4 CancelAdvertisement operation
