tplat

Berkeley Packet Filters

Mon, 01 Jan 0001 00:00:00 +0000

Berkeley Packet Filters

BPF is a filtering syntax used to match traffic by host, network, port, protocol, and other packet attributes.

Primitives

Primitive filter	Description
`[src\|dst] host <host>`	Matches a host as the IP source, destination, or either.
`ether [src\|dst] host <ehost>`	Matches a host as the Ethernet source, destination, or either.
`[src\|dst] net <network>`	Matches packets to or from the source and destination network, or either.
`[src\|dst] net <network> mask <netmask>` or `[src\|dst] net <network>/<len>`	Matches packets with a specific netmask.
`[src\|dst] port <port>` or `[tcp\|udp] [src\|dst] port <port>`	Matches packets sent to or from a port.
`[src\|dst] portrange <p1>-<p2>` or `[tcp\|udp] [src\|dst] portrange <p1>-<p2>`	Matches packets to or from a port range.
`less <length>`	Matches packets less than or equal to the length.
`greater <length>`	Matches packets greater than or equal to the length.
`(ether\|ip\|ip6) proto <protocol>`	Matches an Ethernet, IPv4, or IPv6 protocol.
`(ip\|ip6) protochain <protocol>`	Matches IPv4 or IPv6 packets with a protocol header in the chain, for example `ip6 protochain 6`.
`(ether\|ip) broadcast`	Matches Ethernet or IPv4 broadcasts.
`(ether\|ip\|ip6) multicast`	Matches Ethernet, IPv4, or IPv6 multicasts.
`vlan [<vlan>]`	Matches 802.1Q frames with a VLAN ID.
`mpls [<label>]`	Matches MPLS packets with a label.

Protocols and Operators

Common protocols include arp, ether, fddi, icmp, ip, ip6, link, ppp, radio, rarp, slip, tcp, tr, udp, and wlan.

Creating Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Creating Attack Trees

Creating attack trees helps structure your thinking about threats.

Core Steps

Decide on a representation
Create a root node
Create subnodes
Consider completeness
Prune the tree
Check presentation

1. Decide on a Representation

Choose:

OR tree (most common): any child achieves the parent
AND tree: all children required

Also decide:

Graphical vs outline format

2. Create a Root Node

Two common approaches:

Attacker goal (recommended)
System component

Best practice:

Data Flow Diagrams

Mon, 01 Jan 0001 00:00:00 +0000

Data Flow Diagrams

Data flow models are often the most effective way to perform threat modeling because security issues tend to follow data flow, not control flow. They can be applied to both networked systems and standalone software.

A Data Flow Diagram (DFD) is a structured representation of how data moves through a system. DFDs model:

Processes (running code)
Data stores (where data is held)
Data flows (communication paths)
External entities (outside the system boundary)

flowchart LR
    webClients["Web Clients"]
    sqlClients["SQL Clients"]
    dba["DBA (Human)"]
    dbUsers["DB Users (Human)"]
    logAnalysis["Log Analysis"]

    subgraph dbCluster["DB Cluster"]
        subgraph sqlAccount["Original SQL Account"]
            frontend(["Acme Front End(s)"])
            database(["Database"])
            dbAdmin(["DB Admin"])
        end
        data[("Data")]
        management[("Management")]
        logs[("Logs")]
    end

    webClients <--> frontend
    sqlClients <--> frontend
    frontend <--> database
    database <--> dbAdmin
    dba <--> database
    dba <--> dbAdmin
    dbUsers <--> logAnalysis
    database <--> data
    database <--> management
    database <--> logs
    logs --> logAnalysis
    dba <--> logAnalysis

style dbCluster stroke-dasharray: 5 5
style sqlAccount stroke-dasharray: 5 5

They are especially effective because they:

Distributions

Mon, 01 Jan 0001 00:00:00 +0000

Distributions

A Linux distribution is the Linux kernel bundled with userland tools, package management, and defaults.

Overview

Distros differ by package manager, default tools, desktop environment, and target use case
Common use cases include desktop, server, embedded, and security tooling
The same kernel can feel very different depending on the distribution

Reference

Common distributions

Category	Examples
General purpose	Ubuntu, Fedora, Debian
Enterprise	Red Hat Enterprise Linux, CentOS
Security tooling	Kali Linux, Parrot OS, BlackArch, Pentoo, BackBox
Specialized	Raspberry Pi OS

Debian focus

Known for stability, reliability, and conservative defaults
Common in servers, desktops, and embedded systems
Uses the APT ecosystem for installs, upgrades, and dependency resolution

Property	Notes
Stability	Conservative package updates
Release cycle	Long-term support style releases
Security	Dedicated security updates
Flexibility	Highly configurable
Learning curve	Higher than beginner-focused distros

Trade-offs

Pros: predictable behaviour, strong security track record, large package repository
Cons: older package versions, more manual configuration, less beginner-friendly UX

Mental Model

A distro is an opinionated bundle around the same kernel
The right choice depends on environment and workflow
Most trade-offs come down to stability versus freshness and control versus convenience

Focusing on Assets

Mon, 01 Jan 0001 00:00:00 +0000

Focusing on Assets

An asset-focused approach to threat modeling-centering on “things of value" seems intuitive but is often less effective than expected.

Method

identify assets;
map them to systems;
model interactions;
analyse threats.

Limitations

Definition ambiguity: “Assets” can mean three overlapping things:

Things attackers want (e.g., passwords, financial data)
Things you want to protect (often intangible, like reputation)
Stepping stones to other assets (e.g., systems that provide access)

venn-beta
  title "The overlapping definitions of assets"
  set A["Things you protect"]
  set B["Stepping stones"]
  set C["Things attackers want"]
  union A,B,C
  union A,B
  union B,C
  union A,C

Teams often lack a shared definition, leading to confusion or unproductive discussions.

Foundational

Mon, 01 Jan 0001 00:00:00 +0000

Foundational

Cryptography is the practice and study of techniques for securing communication in the presence of adversaries. The primary goal is to conceal a message so that only intended recipients can understand it.

On Security

The principles of information security provide a framework for protecting data. Confidentiality ensures that information is only accessible to authorized users, for example, encrypting emails so only the intended recipient can read them. Integrity guarantees that data is accurate and unaltered, such as using a checksum to verify a downloaded file has not been tampered with. Availability ensures that information and systems are accessible when needed, like maintaining redundant servers so a website remains online during outages. Authentication confirms the identity of users or systems, for instance, requiring a username and password before accessing an account. Non-repudiation prevents parties from denying their actions, such as using digital signatures to prove the sender authored a document.

Foundational

Mon, 01 Jan 0001 00:00:00 +0000

Foundational

Everybody threat models. For example, when you leave your parked car you lock the door and hide your valuables. This decision is derived from a subconcious action of threat modelling whereby you consider where your car is parked and what threats it may face (i.e., somebody breaking in). When your car is parked in secure garage, you might not think it necessary to hide your valuables. But when your car is parked on a secluded street in a sketchy part of town, your threat model is probably different and, thus, so is the precautions that you take.

If $n$ is even, then $n^2$ is even

Mon, 01 Jan 0001 00:00:00 +0000

If $n$ is even, then $n^2$ is even

Claim:

If $n$ is even, then $n^2$ is even.

Proof:

Assume $n$ is even. Then, by definition, there exists an integer $k$ such that:

$$ n=2k $$

Then:

$$ n^2=(2k)^2 =4k^2 =2(2k)^2 $$

Since $2k^2$ is an integer, $n^2$ is divisible by $2$. Therefore, by direct example, $n^2$ is even.

Claim:

If $n^2$ is even, then $n$ is even.

Proof:

Assume $n$ is odd. Then, by definition, there exists integer $k$ such that:

Nmap

Mon, 01 Jan 0001 00:00:00 +0000

Nmap

Network Mapper (Nmap) is an open-source network scanning and security auditing tool. It uses raw packets to identify live hosts, open ports, services, and, when possible, operating system details.

Host Discovery

Nmap can test whether hosts are reachable before performing a full port scan. A common discovery-only scan is -sn. On local networks, Nmap often uses ARP requests; on routed networks, it typically falls back to ICMP and other probes.

Physical Layer

Mon, 01 Jan 0001 00:00:00 +0000

Physical Layer

The physical layer defines the electrical, mechanical, and procedural interface to the transmission medium. It covers connectors, signalling, line coding, frequencies, and other low-level transmission details.

Remote Photoplethysmography

Mon, 01 Jan 0001 00:00:00 +0000

Remote Photoplethysmography

DepthPhys: Near-Infrared Remote Photoplethysmography in Driver Monitoring Systems

Concise version (15 pages)
Full thesis (63 pages)

Subtle variations in the body can be used to detect underlying physiological signals from camera video data. Existing research in this space is largely focused on extracting physiological signals from traditional two-dimensional planar video data. This project explores how the addition of depth data may be used to augment the results of these approaches. In particular, a novel optical pathway is proposed for camera-based physiological sensing and is validated on a new dataset consisting of seven hours of three-dimensional volumetric near-infrared monochromatic video data. Both two-dimensional and three-dimensional signals are extracted from this dataset and the results of either approach are compared using state-of-the-art camera-based physiological sensing neural methods. These findings provide valuable and novel insight into the utility of three-dimensional signals for camera-based physiological sensing, as well as the capability and limitations of existing camera-based physiological sensing solutions when applied in a driver monitoring system application context.

Sets

Mon, 01 Jan 0001 00:00:00 +0000

Sets

A set is just a collection of distinct objects.

Examples:

$\mathbb{R}$: real numbers
$\{1,2,3\}$
solutions to an equation

In pure math, you define things by properties, not construction.

Shell Prompt

Mon, 01 Jan 0001 00:00:00 +0000

Shell Prompt

The shell prompt shows that the shell is ready for input and often encodes the current user, host, and directory.

Overview

Prompt format usually includes user, host, and working directory
PS1 controls most Bash prompt formatting
The ending symbol usually signals privilege level

Reference

Common symbols

Symbol	Meaning
`~`	Home directory
`$`	Regular user
`#`	Root user

`PS1`

PS1="\u@\h[\w]\$ "

Escape	Meaning
`\u`	Username
`\h`	Short hostname
`\H`	Full hostname
`\w`	Current working directory
`\d`	Date
`\D{format}`	Custom date format
`\t`	24-hour time
`\T`	12-hour time
`\@`	AM/PM time
`\j`	Number of jobs
`\s`	Shell name
`\n`	Newline
`\r`	Carriage return

Customisation and logging

Prompt settings usually live in ~/.bashrc
~/.bash_history stores previously executed commands
script records a full terminal session

Minimal prompts

$
#

Mental Model

Prompt = context plus readiness indicator
PS1 defines the formatting
Symbols such as $ and # show privilege level

Spoofing

Mon, 01 Jan 0001 00:00:00 +0000

Spoofing

Spoofing is pretending to be something or someone you’re not. Spoofing violates authentication.

Typical victims include processes, external entities, or people.

Example Threats

Spoofing a person
spoofing a process
spoofing a “file” on disk
spoofing a network address
spoofing a machine
spoofing a role.

User Management

Mon, 01 Jan 0001 00:00:00 +0000

User Management

User management covers accounts, groups, passwords, and privilege elevation.

Overview

Users can be created, modified, grouped, and removed
sudo is the standard way to run a command with elevated privileges without logging in as root
Group membership is a common way to grant shared access

Reference

Command	Purpose
`sudo`	Run a command as another user, usually root
`su`	Switch user and start a shell
`useradd`	Create a user
`userdel`	Remove a user
`usermod`	Modify a user account
`addgroup`	Add a group
`delgroup`	Remove a group
`passwd`	Change a password

Mental Model

Users own access
Groups share access
sudo provides controlled privilege escalation

Verilog

Mon, 01 Jan 0001 00:00:00 +0000

Verilog

Keywords

wire

wire keyword represents a physical wire in a circuit and is used to connect gates or modules.

wire is a type of net that describes digital signals connecting multiple hardware elements.

wire does not store its value but must be driven by a continuous assignment statement assign or by connecting it to the output of a gate or module.

Value of a wire can be read or assigned inside a module but never inside procedural code such as intial or always blocks.

1-bit MUX

Mon, 01 Jan 0001 00:00:00 +0000

1-bit MUX

A multiplexer (MUX) is an electronic switch that conencts one of several inputs to the output based on a selection signal S. The truth table for a 1-bit MUX is shown in Table 1.

Table 1: Truth table of a 1-bit MUX.

X	Y	S	Z
0	xx	1	0
1	xx	1	1
xx	0	0	0
xx	1	0	1

As shown in Table 1, when the selector signal is 1, the output signal mirrors input signal X. Conversely, when the selector signal is 0 the output signal mirrors the input signal Y.

Data Link Layer

Mon, 01 Jan 0001 00:00:00 +0000

Data Link Layer

The data link layer transfers frames between devices on the same local network segment. It also defines how devices identify one another on the local link and how frames move across the physical medium.

The data link layer handles: The data link layer transfers frames between nodes on the same local network segment. It can also detect and sometimes correct errors from the physical layer.

The data link layer handles:

Focusing on Attackers

Mon, 01 Jan 0001 00:00:00 +0000

Focusing on Attackers

An attacker-focused approach to threat modeling—starting from “who might attack us and why”-is intuitive but generally not very effective.

Method

Create attacker profiles (from simple lists to detailed personas).
Use these to guide brainstorming about possible attacks.
Often shifts toward human-centric scenarios (e.g., social engineering).

Appeal and use cases:

It feels logical: if attackers drive risk, understanding them should help.
It can work for experienced security practitioners, for incorporating less-technical input, and for communicating risk or prioritisation.
Makes threats more tangible, especially for non-technical stakeholders.
Useful for explaining who might attack and why, aiding communication and buy-in.

Limitations

Discussions easily get bogged down in debating attacker capabilities (e.g., “state-sponsored or not?”).
Personas lack enough structure to reliably derive concrete threats.
Engineers may project their own assumptions onto attackers, leading to bias and missed risks.
Human-centric scenarios can be hard to translate into actionable system security measures.

Attacker-centric modelling does not produce consistent or systematic threat identification. It does not reliably answer the key question: what will attackers actually do to the system?

Functions

Mon, 01 Jan 0001 00:00:00 +0000

Functions

A function $f: A \to B$ is:

a set $A$ (domain)
a set $B$ (codomain)
a rule assigning each element of $A$ to exactly one element of $B$
- many elements of $A$ may beassigned to one element of $B$, but to only one element of $B$

If $n$ is odd, then $n^2$ is odd

Mon, 01 Jan 0001 00:00:00 +0000

If $n$ is odd, then $n^2$ is odd

Claim:

If $n$ is odd, then $n^2$ is odd.

Proof:

Assume $n$ is odd. Then, by definition, there exists an integer $k$ such that:

$$ n=2k+1 $$

Then:

$$ n^2=(2k+1)^2 =(2k+1)(2k+1) =4k^2+4k+1 =2(2k^2+2k)+1 $$

Let $m=2k^2+2k$, which is an integer. Then:

$$ n^2=2m+1 $$

Therefore, by direct example, $n^2$ is odd.

Claim:

If $n^2$ is odd, then $n$ is odd.

Proof:

Consider the contrapositive; if $n$ is odd, then $n^2$ is odd. We have already shown this to be true. Therefore, by contrapositive, $n$ is odd.

Package Management

Mon, 01 Jan 0001 00:00:00 +0000

Package Management

Package managers install software, resolve dependencies, and keep systems updated.

Overview

Packages bundle binaries, configuration, and dependency metadata
Package managers add install, remove, upgrade, and repository workflows
Debian-based systems commonly use dpkg and apt

Reference

Common tools

Command	Purpose
`dpkg`	Install and manage Debian package files
`apt`	High-level package manager for Debian-based systems
`aptitude`	Alternative front end for Debian package management
`snap`	Install and manage snap packages
`gem`	Manage Ruby packages
`pip`	Install Python packages
`git`	Distributed version control and source retrieval

APT

dpkg works with local .deb files
apt handles dependency resolution through repositories
/etc/apt/sources.list defines the repositories a system can query
apt-cache searches the local package cache

apt-cache search impacket

Mental Model

Use dpkg for package files and apt for dependency-aware installs
Repository metadata is as important as the package itself
Package managers trade manual effort for repeatable installation and updates

Permissions

Mon, 01 Jan 0001 00:00:00 +0000

Permissions

Linux permissions use an owner, group, and others model to control access to files and directories.

Overview

Permission bits define read, write, and execute access
Files and directories interpret those bits differently
chmod, chown, and special bits modify access rules

Reference

Permission types

Symbol	Meaning
`r`	Read
`w`	Write
`x`	Execute

Permission scope

Scope	Meaning
`u`	Owner
`g`	Group
`o`	Others

File vs directory semantics

Object	`r`	`w`	`x`
File	Read contents	Modify contents	Execute file
Directory	List entries	Create or remove entries	Traverse directory

Directory traversal requires x, even if r is set
x on a directory does not mean you can execute files inside it
Changing directory contents requires w on the directory itself

Representation

ls -l /etc/passwd
-rwxrw-r-- 1 root root 1641 May 4 23:42 /etc/passwd

Segment	Meaning
`-`	File type
`rwx`	Owner permissions
`rw-`	Group permissions
`r--`	Others permissions
`1`	Hard link count
`root root`	Owner and group
`1641`	File size
`May 4 23:42`	Last modified

Octal notation

Value	Permission
`4`	Read
`2`	Write
`1`	Execute

Example	Meaning
`7`	`rwx`
`6`	`rw-`
`5`	`r-x`
`4`	`r--`

rwxrw-r-- = 764

Modifying permissions

chmod a+r shell
chmod 754 shell
chown <user>:<group> <file-or-directory>

chmod adds or removes permissions with symbolic or numeric modes
chown changes the owner and optionally the group

Special bits

SUID and SGID run a program with the file owner’s or group’s privileges
The sticky bit prevents users from deleting files they do not own in shared directories
In ls -l, s replaces x for SUID or SGID, and t marks the sticky bit

Mental Model

Ownership sets the baseline
Groups extend access
Permission bits gate operations
Special bits change how execution and deletion behave

Protocol Data Unit

Mon, 01 Jan 0001 00:00:00 +0000

Protocol Data Unit

A protocol data unit (PDU) is a single unit of information transmitted among peer entities of a computer network.

flowchart LR

subgraph Bit
    Physical
end

subgraph Frame
    Link
end

subgraph Packet
    Network
end

subgraph Segment[Segment / Datagram]
    Transport
end

subgraph Data
    Session
    Presentation
    Application
end

Bit --> Frame --> Packet --> Segment --> Data

Representing Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Representing Attack Trees

Attack trees can be represented in different formats depending on the audience and purpose.

Graphical Representation

graph TD
    A[Attack system]

    A -->|AND| B[Gather knowledge]
    A -->|AND| C[Gain access]

    B -->|OR| B1[From insider]
    B -->|OR| B2[From components]

    C -->|OR| C1[Vendor access]
    C -->|OR| C2[Illegal entry]

Outline Format

Attack system (AND)

1.1 Gather knowledge (OR)
- Insider
- Components
1.2 Gain access (OR)
- Vendor
- Illegal entry

Structured Representations

Attack trees can also be treated as data structures.

Subsurface Scattering

Mon, 01 Jan 0001 00:00:00 +0000

Subsurface Scattering

Harnessing coherent illuminator properties to detect subsurface scattering

The coherent light output by a laser yields unique interference properties in comparison to incoherent light sources. This project harnesses these unique properties to discern bare skin from other categories present on the face within the constraints defined by a driver monitoring software (DMS) application context. More specifically, the project uses various laser speckle imaging techniques on vertical-cavity surface-emitting laser illuminated images to perform clustering of bare skin. Three distinct methods are investigated: beam profile analysis, laser speckle variation analysis and laser speckle contrast imaging (LSCI). All methods are evaluated and a comparison is made highlighting the respective benefits and drawbacks of each technique in a DMS application context. In the final implementation, a convolutional neural network is trained to use temporal LSCI processed images to effectively classify skin. A comparison of models trained on light-emitting diode (LED) versus VCSEL illuminated datasets is presented and a consistent improvement in classification performance is demonstrated for the VCSEL models. Finally, a comprehensive evaluation is provided into the limitations of this model.

Tampering

Mon, 01 Jan 0001 00:00:00 +0000

Tampering

Tampering is modifying something you’re not supposed to modify. Tampering violates integrity. It can include packets on the wire (or wireless), bits on disk, or the bits in memory.

Typical victims include data stores, data flows, or processes.

Example Threats

Tampering with a file
racing to create a file (tampering with the file system)
tampering with a network packet
tampering with memory.

tcpdump

Mon, 01 Jan 0001 00:00:00 +0000

tcpdump

tcpdump is a command-line packet sniffer that can capture and interpret data frames from a file or network interface. It supports Berkeley Packet Filter syntax.

To capture network traffic from the wire, it uses pcap and libpcap with an interface in promiscuous mode. This lets the program see packets sourced from or destined for any device on the local network, not just traffic addressed to the host.

In networking, promiscuous mode allows a network device, such as a network interface card (NIC), to intercept and read every data packet passing through its network segment rather than just packets specifically addressed to it.

Unified Modeling Language

Mon, 01 Jan 0001 00:00:00 +0000

Unified Modeling Language

Unified Modeling Language (UML) diagrams can be adapted for threat modeling, especially if they are already part of the development workflow. In this case, you need only add trust boundaries to highlight security-relevant separations between components.

Advantages

Leverages existing artifacts (presuming you are already using UML in your project): No need to redraw system models
Expressive and detailed: UML supports a wide range of diagram types:
- Structure diagrams
- Behavior diagrams
- Interaction diagrams

Limitations

High complexity: UML includes many symbol conventions, requiring strong familiarity to interpet correctly

1-bit Full Addder

Mon, 01 Jan 0001 00:00:00 +0000

1-bit Full Addder

A full adder is an adder with carry-in and carry-out ports. The truth table for a 1-bit full adder is shown in Table 1.

Table 1: Truth table for a 1-bit full adder.

X	Y	C_in	Z	C_out
0	0	0	0	0
0	1	0	1	0
1	0	0	1	0
1	1	0	0	1
0	0	1	1	0
0	1	1	0	1
1	0	1	0	1
1	1	1	1	1

As shown in Table 1, the output $Z$ is the binary addition of $X + Y + C_{in}$, and the output $C_{out}$ is the carry bit of the addition.

Elevation of Privlege

Mon, 01 Jan 0001 00:00:00 +0000

Elevation of Privlege

Elevation of Privelege is a game created by Adam Shostack in which

Example Attack Tree

Mon, 01 Jan 0001 00:00:00 +0000

Example Attack Tree

Goal: Access a Building

This is a simple OR-based attack tree.

graph TD
    A[Access building]

    A --> B[Through a door]
    A --> C[Through a window]
    A --> D[Through a wall]
    A --> E[Other means]

    %% Door branch
    B --> B1[Unlocked]
    B --> B2[Drill lock]
    B --> B3[Pick lock]
    B --> B4[Use key]
    B --> B5[Social engineering]

    B1 --> B11[Get lucky]
    B1 --> B12[Block latch]
    B1 --> B13[Distract staff]

    B4 --> B41[Find key]
    B4 --> B42[Steal key]
    B4 --> B43[Copy key]
    B4 --> B44[Social engineer key]

    B5 --> B51[Follow someone in]
    B5 --> B52[Build relationship]
    B5 --> B53[Carry items to appear legitimate]

    %% Window branch
    C --> C1[Break window]
    C --> C2[Lift window]

    %% Wall branch
    D --> D1[Use tools]
    D --> D2[Use vehicle]

    %% Other means
    E --> E1[Fire escape]
    E --> E2[Roof access]
    E --> E3[Another tenant]

Focusing on Software

Mon, 01 Jan 0001 00:00:00 +0000

Focusing on Software

Shostack argues software-centric threat modelling (focusing on the system’s actual architecture and behavior) is more effective and practical than asset or attacker-centric modelling.

Method

Model the software itself (architecture, data flows, components, APIs).
Use diagrams or shared representations to build a common understanding of how the system works.

Advantages

Shared understanding: Exposes mismatches in how team members think the system behaves, often revealing security gaps.
Handles complexity: Helps untangle and make visible the accumulated complexity of long-running or large systems.
Surfaces assumptions: Forces explicit identification of hidden or incorrect assumptions between components.
Immediate security value: Even before identifying threats, aligning understanding improves security posture.
Works across different types of software:
- “Boxed” software (clearly defined boundaries like apps or packages)
- Deployed systems (evolving infrastructure and services)
Developers are familiar with their own software. This is reliable, unlike assumptions about assets or attackers.
Doesn’t rely on vague or inconsistent concepts (like “assets” or “attacker personas”).
Provides a concrete, structured foundation for systematically identifying threats.

Takeaway

Software-centric modeling works because it starts from something concrete, shared, and well-understood: the system itself. This makes it more reliable, reproducible, and effective for identifying and addressing threats than asset or attacker-focused approaches.

If $x^2>0$, then $x>0$

Mon, 01 Jan 0001 00:00:00 +0000

If $x^2>0$, then $x>0$

Claim:

If $x^2>0$, then $x>0$

Proof:

Let $x=-2$

Then $x^2=4>0$, but $x>0$ is false.

Therefore, by counterexample, the statement is false.

IoT Bushfire Detection

Mon, 01 Jan 0001 00:00:00 +0000

IoT Bushfire Detection

Power Requirements of Ground-Based Bushfire Detection Devices

Recently, there has been increased interested in the use of ground-based Internet of Things (IoT) sensors for bushfire detection applications. Such a system typically comprises sensors and a gateway to collect information and relay it to a control station. A key requirement of such systems is that devices are optimised for the lowest possible power consumption. This paper will focus on the power requirements of such a system and seek to evaluate the feasibility of various power sources. Power consumption is investigated for various detection methods. This is used to calculate lifetime power consumption for various combinations of detection methods (device configurations) under different operating conditions. Finally, research is conducted into several potential power sources. This concludes with a recommendation for a secondary cell with a solar panel for visual detection methods and a primary cell for all other detection methods.

Logic

Mon, 01 Jan 0001 00:00:00 +0000

Logic

Implication

If $P$, then $Q$; written as $P \implies Q$

Whenever $P$ is true, then $Q$ must also be true

Network Layer

Mon, 01 Jan 0001 00:00:00 +0000

Network Layer

The network layer is responsible for packet forwarding between hosts, including routing through intermediate routers. It provides:

Connectionless communication.
Host addressing.
Message forwarding.

Internet Protocol

The Internet Protocol (IP), introduced in RFC 791, exists at the network layer. IP routes packets, encapsulates data, and fragments and reassembles datagrams when they reach the destination host. By design, IP is connectionless and provides no guarantee that data will reach its intended recipient.

Network Security

Mon, 01 Jan 0001 00:00:00 +0000

Network Security

Network security focuses on protecting availability, integrity, and confidentiality in connected systems. Common attacks target bandwidth, routing, name resolution, and device access, so defenses usually combine filtering, redundancy, and monitoring.

Firewalls

A firewall controls traffic between network segments by applying a rule set to each connection attempt. It can be implemented in software, hardware, or both, and it decides whether packets are allowed, dropped, or blocked. The goal is to prevent unauthorized or unwanted connections.

Repudiation

Mon, 01 Jan 0001 00:00:00 +0000

Repudiation

Repudiation means claiming you didn’t do something (regardless of whether you did or not). Repudiation violates non-repudation.

Typical victims include processes.

Example Threats

No logs means you can’t prove anything
logs come under attack
logs as a channel for attack.

Service and Process Management

Mon, 01 Jan 0001 00:00:00 +0000

Service and Process Management

Services and processes are background workloads controlled with systemd, signals, and job control.

Overview

Services can be started, stopped, restarted, enabled, and inspected
Processes are identified by PIDs and may have parent processes
Job control and command chaining are common shell workflows

Reference

`systemctl`

start, stop, restart, and status control service state
enable makes a service start at boot
systemctl list-units --type=service shows active services

systemctl list-units --type=service

Process control

Common states: running, waiting, stopped, zombie
kill, pkill, pgrep, and killall send signals or locate processes
kill -l lists available signals

Job control

Ctrl+Z suspends the current job
jobs lists suspended or background jobs
bg resumes a job in the background
fg <id> returns a job to the foreground
& runs a command in the background immediately

Command chaining

; runs commands sequentially
&& runs the next command only on success
| sends stdout from one command to the next

Mental Model

systemd manages service lifecycle on most modern distributions
PIDs identify running processes and /proc exposes process details
Signals request state changes; jobs manage interactive shell work
Simple commands become more powerful when chained together

Swim Lane Diagrams

Mon, 01 Jan 0001 00:00:00 +0000

Swim Lane Diagrams

Swim lane diagrams are a visual method for modeling interactions between participants in a system or protocol. They are particularly useful for understanding message flows over time, or when modelling human + system interaction.

Each participant (e.g., client, server) is represented by a vertical “lane”
Time flows downward along each lane
Messages are shown as horizontal arrows between participants
Each lane is labeled to identify the participant

This layout resembles swimming lanes, hence the name.

Termshark

Mon, 01 Jan 0001 00:00:00 +0000

Termshark

Termshark is a text-based user interface (TUI) application that provides a Wireshark-like interface in the terminal.

Brainstorming

Mon, 01 Jan 0001 00:00:00 +0000

Brainstorming

One of the most simple ways to identify threats is to host a brainstorming session. Brainstorming can be broken down into (1) a period of idea generation, and (2) a period of filtering where the best ideas are selected. Before brainstorming, it is often helpful to define the scope of attacks under consideration.

On its own, brainstorming is not a sufficient form of threat modelling. This is because it is (deliberately) unstructured, and does not provide a high degree of confidence that all threats have been identified - i.e., did your brainstorming session end because you found all threats, or because you became tired / the meeting ended?

Hazards

Mon, 01 Jan 0001 00:00:00 +0000

Hazards

The 1-bit multiplexer and 1-bit full adder exercises treat circuits as ideal, i.e., with instantaneous signal changes. However, transition times in digital circuits are non-zero. When designing asynchronous digital circuits, attention must be paid to the possible presence of hazards.

Note:

All combinational circuits are asynchronous.

Consider the previously defined 1-bit multiplexer.

Figure 1: Schematic description of 1-bit MUX.

Not all signal pathways corss the same number of gates, which means they will be affected by varying amounts of delay. This can introduce timing hazards.

Information Disclosure

Mon, 01 Jan 0001 00:00:00 +0000

Information Disclosure

Information Disclosure is about exposing information to people who are not authorised to see it. Information disclosure violates confidentiality.

Typical victims include processes, data stores, or data flows.

Example Threats

Network monitoring
directory of filename
file contents
API disclosure.

Real-World Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Real-World Attack Trees

Several published attack trees provide valuable reference material.

Fraud Attack Tree

Election Threat Trees

SSL Mind Map

Observations

Flexible but less structured
Harder to navigate visually
Inconsistent categorisation

State Diagrams

Mon, 01 Jan 0001 00:00:00 +0000

State Diagrams

State diagrams model a system as a set of states and transitions between those states. They are useful for analysing how a system behaves in response to inputs and how it enforces rules over time.

A system is represented as a state machine with:

States (current condition of the system)
Transitions (movement between states)
Inputs/messages that trigger transitions
Internal data/memory influencing behavior

stateDiagram-v2
    [*] --> Closed

    Closed --> Opened: open
    Opened --> Closed: close

    Closed --> Locked: lock
    Locked --> Closed: unlock

From a threat modelling perspective, state diagrams can help to evaluate whether each transition enforces proper validation and security checks, and to identify:

Task Scheduling

Mon, 01 Jan 0001 00:00:00 +0000

Task Scheduling

Task scheduling runs commands later, repeatedly, or at boot.

Overview

systemd timers are the native option on modern Linux systems
cron is a simple, time-based scheduler that remains widely used

Reference

`systemd` timers

A timer unit usually has a matching service unit
OnBootSec runs once after boot
OnUnitActiveSec repeats after the previous run
Reload unit files with systemctl daemon-reload

[Unit]
Description=My Timer

[Timer]
OnBootSec=3min
OnUnitActiveSec=1hour

[Install]
WantedBy=timers.target

[Unit]
Description=My Service

[Service]
ExecStart=/full/path/to/my/script.sh

[Install]
WantedBy=multi-user.target

Cron

Field	Values
Minute	`0-59`
Hour	`0-23`
Day of month	`1-31`
Month	`1-12`
Day of week	`0-7`

0 */6 * * * /path/to/update_software.sh
0 0 1 * * /path/to/scripts/run_scripts.sh
0 0 * * 0 /path/to/scripts/clean_database.sh
0 0 * * 7 /path/to/scripts/backup.sh

Mental Model

Use timers when you want native systemd integration
Use cron when you want compact recurring schedules
Prefer the simplest scheduler that fits the job

Transport Layer

Mon, 01 Jan 0001 00:00:00 +0000

Transport Layer

The transport layer provides end-to-end communication services for applications. It handles connection-oriented communication, reliability, flow control, congestion control, and multiplexing.

Connection-oriented communication.
In-order delivery.
Reliability.
Flow control.
Congestion control.
Multiplexing.

TCP vs. UDP

The Transmission Control Protocol (TCP) (RFC 793) and User Datagram Protocol (UDP) (RFC 768) reside at the transport layer.

Characteristic	TCP	UDP
Transmission	Connection-oriented	Connectionless.
Connection establishment	Uses a three-way handshake.	Does not verify that the destination is listening.
Data delivery	Stream-based.	Packet-based.
Receipt of data	Uses sequence and acknowledgment numbers.	Does not track receipt.
Speed	More overhead, but reliable.	Faster, but unreliable.

TCP

TCP uses flags in the header. The three flags worth remembering first are SYN, ACK, and FIN.

TShark

Mon, 01 Jan 0001 00:00:00 +0000

TShark

TShark is a purpose-built terminal tool based on Wireshark. It shares many of the same features, syntax, and options.

Core Linux Commands

Mon, 01 Jan 0001 00:00:00 +0000

Core Linux Commands

Common commands are easier to remember when grouped by discovery, inspection, navigation, and search.

Overview

man and apropos help you discover commands
which resolves the executable that will run
find is precise and real-time; locate is fast and indexed

Reference

Discovery

Command	Purpose
`man`	Read manual pages
`apropos`	Search manual page descriptions by keyword
`explainshell`	External reference for command syntax

System inspection

Command	Purpose
`whoami`	Print the current user
`id`	Show user and group IDs
`hostname`	Get or set the hostname
`uname`	Show kernel and system information
`pwd`	Print the current directory
`env`	Show or set environment variables
`ps`	Inspect processes
`who`	Show logged-in users
`lsof`	Show open files
`lsblk`	List block devices
`lsusb`	List USB devices
`lspci`	List PCI devices

Networking

Command	Purpose
`ifconfig`	Legacy network interface tool
`ip`	Modern network interface tool
`netstat`	Legacy network status tool
`ss`	Inspect sockets

File and path utilities

Command	Purpose
`ls`	List directory contents
`cd`	Change directory
`which`	Show the executable path for a command

ls -l /etc
which python

ls -a includes hidden files. cd - returns to the previous directory.

Denial of Service

Mon, 01 Jan 0001 00:00:00 +0000

Denial of Service

Denial of Service are attacks designed to prevent a system from providing service, including by crashing it, making it unusably slow, or filling all its storage. These threats often falls toward the bottom of the stack, because they primarily impact availability and not confidentiality or integrity. Denial of service violates availability.

Typical threats include processes, data stores, or data flows.

Example Threats

Network flooding;
program resources;
system resources.

Limitations and Perspective

Mon, 01 Jan 0001 00:00:00 +0000

Limitations and Perspective

Attack trees are useful but not without challenges.

Key Issues

1. Completeness

No guarantee all attack paths are captured
Missing a root node can omit entire threat classes
Hard to know when you’re “done”

2. Scoping

Some attacks fall outside your control
Example: hardware-level attacks vs software systems

You must define:

What is in scope
What is someone else’s responsibility

3. Meaning and Consistency

AND/OR semantics often unclear
Sequence rarely well-defined
Different authors use different conventions

This increases cognitive load when interpreting trees.

Overflow Counter

Mon, 01 Jan 0001 00:00:00 +0000

Overflow Counter

An overflow counter is a counter that can overflow back to zero when it fills up.

In the overflow counter subfolder, a 32-bit overflow counter is implemented for a Basys 3 FPGA board, part number: xc7a35tcpg236-1.

The counter has 3 inputs: (1) clk, (2) reset, and (3) enable with the output being a 16-bit bus entity called led. The counter has the following behaviour:

At every positive (i.e., rising) edge of the clk signal, the counter’s value increases by 1. This is achieved using a procedural block that will be edge-triggered by the clock. This is specified by the condition posedge clk.
For condition reset == 1, the counter’s value resets to 0. When reset == 0, the counter increments.
The counter increments when enabled (i.e., enable == 1) and stops incrementing when disbled (enable == 0).

The full procedural block describing this behaviour is given by:

Session Layer

Mon, 01 Jan 0001 00:00:00 +0000

Session Layer

The session layer provides the mechanism for opening, closing, and managing a session between end-user application processes. It supports a semi-permanent dialogue between endpoints.

Trust Boundaries

Mon, 01 Jan 0001 00:00:00 +0000

Trust Boundaries

A trust boundary is any point where entities with different privileges or trust levels interact.

Every system has at least one trust boundary because all computation occurs in some context.

If no boundaries are visible:

Either everything is incorrectly assumed to have equal privilege
Or the model is missing structure

In the extreme case where everything truly shares the same trust level, draw one boundary around the entire system and move on.

Wireshark

Mon, 01 Jan 0001 00:00:00 +0000

Wireshark

Wireshark is the feature-rich GUI option for traffic capture and analysis. wireshark supports Berkeley Packet Filter syntax.

Clock Division

Mon, 01 Jan 0001 00:00:00 +0000

Clock Division

The overflow counter project uses a 100 MHz clock signal. In many cases, it is necessary to generate clock signals slower than 100 Hz. A very efficient way to do this is to perform clock division using an overflow counter.

Clock Division using an Overflow Counter

The simplest way to generate a clock divided by a factor of $2^n$ is to output the (n-1)th bit of an overflow counter (n-1 because bus indexing starts at 0).

Elevation of Privelege

Mon, 01 Jan 0001 00:00:00 +0000

Elevation of Privelege

Elevation of Privilege is when a program or user is technically able to do things that they’re not supposed to do. These threats are almost always going to fall into the highest priority category, because when they’re exploited they lead to so much damage. Denial of service violates authorisation.

Typical victims include processes.

Example Threats

Data/code confusion;
control flow/memory corruption attacks;
command injection attacks.

File Descriptors and Redirection

Mon, 01 Jan 0001 00:00:00 +0000

File Descriptors and Redirection

File descriptors provide a uniform way for processes to read and write streams.

Overview

0 is stdin, 1 is stdout, and 2 is stderr
Redirection rewires those streams to files or /dev/null
Pipes connect the output of one command to the input of another

Reference

Standard file descriptors

FD	Name	Purpose
`0`	STDIN	Standard input
`1`	STDOUT	Standard output
`2`	STDERR	Standard error

Redirection

Operator	Meaning
`>`	Overwrite a file with stdout
`>>`	Append stdout to a file
`<`	Use a file as stdin
`2>`	Redirect stderr
`1>`	Redirect stdout explicitly

find /etc/ -name networks 2>/dev/null
find /etc/ -name networks > results.txt
find /etc/ -name networks 2>/dev/null 1>stdout.txt
cat < stdout.txt

Here documents

cat << EOF >> stream.txt
My
Input
Stream
EOF

Pipes

find /etc/ -name "*.conf" 2>/dev/null | grep systemd | wc -l

Mental Model

Each process reads from FD 0 and writes to FD 1 or 2
Redirection changes where those streams go
Pipes build dataflow pipelines between commands
/dev/null is a sink for discarded output

Presentation Layer

Mon, 01 Jan 0001 00:00:00 +0000

Presentation Layer

The presentation layer serves as the data translator for the network. It provides:

Data conversion.
Character code translation.
Compression.
Encryption and decryption.
Serialisation.

Application Layer

Mon, 01 Jan 0001 00:00:00 +0000

Application Layer

The application layer defines the communication protocols and interface methods used by hosts in a network.

HTTP

Hypertext Transfer Protocol (HTTP) lives at the application layer and enables cleartext communication between a client and server over TCP. HTTP commonly uses ports 80 and 8000.

Method	Description
HEAD	Requests the same resource as `GET` without the response body. Useful for metadata and health checks.
GET	Reads data from the server.
POST	Submits data for processing.
PUT	Creates or replaces a resource at the target URI.
DELETE	Removes the resource at the target URI.
TRACE	Echoes the request for diagnostics.
OPTIONS	Reports the methods supported by the target resource.
CONNECT	Establishes a tunnel, usually through a proxy.

HTTPS

HTTP Secure (HTTPS) wraps HTTP in TLS so the conversation can be encrypted end to end. It commonly uses ports 443 and 8443 instead of port 80.

Seven Segment Display

Mon, 01 Jan 0001 00:00:00 +0000

Seven Segment Display

The Basys 3 board features a four-digit common anode seven-segment LED display. Each of the four digits is comprised of seven segments, with an LED embedded in each segment. Segment LEDs can be individually illuminated. Any of the 128 (2^7) patterns can be displayed on a digit by illuminating certain LED segments and leaving the others dark.

Figure 1: Seven segment display.

The anodes of the seven LED segments are tied together to form one common anode circuit node. The common anode signals are available as four digit enable input signals (i.e., 1000 will enable the first anode, but not the other three). The cathode circuit connections are shared amongst the four digits. There are only eight cathode signals that are drivable from the FPGA chip, called CA, CB, …, CG and DP (decimal point), and there are connected to all four digits on the display.

SSH

Mon, 01 Jan 0001 00:00:00 +0000

SSH

SSH is the standard protocol for secure remote command execution and administration on Unix-like systems.

Overview

Provides encrypted remote access without a GUI
Is widely installed and efficient on low-resource systems
Commonly used for administration, automation, and file transfer workflows

Reference

ssh user@host

Mental Model

SSH replaces insecure remote login methods with an encrypted channel
It is the default way to manage many remote Linux systems

Regular Expressions (Regex)

Mon, 01 Jan 0001 00:00:00 +0000

Regular Expressions (Regex)

Regex patterns match and filter text. In Linux they are commonly used with grep, sed, and awk.

Overview

Regex is compact and composable
Start with simple patterns and add anchors or grouping only when needed
Most mistakes come from precedence, escaping, or incorrect anchoring

Reference

Core constructs

Pattern	Meaning
`.`	Any character
`*`	Zero or more of the previous token
`+`	One or more of the previous token
`?`	Zero or one of the previous token
`^`	Start of line
`$`	End of line
`\b`	Word boundary
`\w`	Word character
`[]`	Character class
`()`	Grouping
`\|`	OR operator

`grep` modes

Option	Meaning
`grep`	Basic regex
`grep -E`	Extended regex; usually preferred
`grep -v`	Invert the match

Common patterns

Use case	Pattern
Starts with a word	`^word`
Ends with a word	`word$`
Contains a word	`word`
Word boundary	`\bword\b`
Starts with A, ends with B	`^A.*B$`
A or B	`A\|B`

Examples

Task	Command
Exclude comment lines	`grep -v '#' /etc/ssh/sshd_config`
Match words starting with `Permit`	`grep -E '\bPermit\w*' /etc/ssh/sshd_config`
Match words ending with `Authentication`	`grep -E '\w*Authentication\b' /etc/ssh/sshd_config`
Match lines containing `Key`	`grep 'Key' /etc/ssh/sshd_config`
Match lines starting with `Password` and containing `yes`	`grep -E '^Password.*yes' /etc/ssh/sshd_config`
Match lines ending with `yes`	`grep -E 'yes$' /etc/ssh/sshd_config`

Best practices

Prefer grep -E for extended regex
Avoid unnecessary cat; pipe the file directly into the command
Build patterns incrementally and verify anchors and grouping

Mental Model

Regex matches text by combining anchors, quantifiers, and grouping
^ and $ constrain position
* and + control repetition
Parentheses and | change matching logic

Mon, 01 Jan 0001 00:00:00 +0000

Nmap Scan Report - Scanned at Tue Jun 30 10:02:24 2026

Scan Summary

Nmap 7.99 was initiated at Tue Jun 30 10:02:24 2026 with these arguments:
nmap -sT --disable-arp-ping -oX target 10.129.240.88