Security based on event locations are insecure and can be
spoofed.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Authorization
If one trusts the system-event information and executes commands based
on it, one could potentially take actions based on a spoofed
identity.
Likelihood of Exploit
High
Demonstrative Examples
Example 1
(Bad Code)
Java
public void actionPerformed(ActionEvent e) {
if (e.getSource()==button) System.out.println("print out
secret information");
}
Potential Mitigations
Phase
Description
Design through Implementation: Never trust or rely any of the
information in an Event for security.
Other Notes
Events are a messaging system which may provide control data to programs
listening for events. Events often do not have any type of authentication
framework to allow them to be verified from a trusted source. Any
application, in Windows, on a given desktop can send a message to any window
on the same desktop. There is no authentication framework for these
messages. Therefore, any message can be used to manipulate any process on
the desktop if the process does not check the validity and safeness of those
messages.
Description
