UNPKG

openclaw

Version:

Multi-channel AI gateway with extensible messaging integrations

github.com/openclaw/openclaw

openclaw/openclaw

48 lines (39 loc) • 6.19 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
--- summary: "OpenClaw initial access threats (AML.TA0004): T-ACCESS-001, T-ACCESS-002, T-ACCESS-003" title: "Initial access (AML.TA0004)" read_when: - Reviewing initial access threats against an OpenClaw deployment - Working on mitigations for T-ACCESS-001, T-ACCESS-002, T-ACCESS-003 --- Threats in the initial access tactic (AML.TA0004) of the [MITRE ATLAS](https://atlas.mitre.org/) framework. Each entry lists the ATLAS technique, attack vector, affected components, current mitigations, residual risk, and recommendations. The trust boundaries and data flows these threats cross are defined in the [threat model index](/security/THREAT-MODEL-ATLAS), which also holds the risk matrix, the recommendations summary, and the ATLAS technique mapping. ## T-ACCESS-001: Pairing code interception | Attribute | Value | | ----------------------- | ----------------------------------------------------------------------------------------------------- | | **ATLAS ID** | AML.T0040 - AI Model Inference API Access | | **Description** | Attacker intercepts a pairing code during the pairing window (1h DM/generic pairing, 5m node pairing) | | **Attack vector** | Shoulder surfing, network sniffing, social engineering | | **Affected components** | Device pairing system | | **Current mitigations** | 1h TTL (DM/generic pairing), 5m TTL (node pairing); codes sent via the existing channel | | **Residual risk** | Medium - pairing window exploitable | | **Recommendations** | Reduce pairing window, add a confirmation step | ## T-ACCESS-002: AllowFrom spoofing | Attribute | Value | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **ATLAS ID** | AML.T0040 - AI Model Inference API Access | | **Description** | Attacker spoofs an allowed sender identity on a channel | | **Attack vector** | Channel-dependent - phone number spoofing, username impersonation | | **Affected components** | Per-channel AllowFrom validation | | **Current mitigations** | Channel-specific identity verification; graded identifier-authentication gate uses `min(entry, subject)` over `verified > asserted > unverified > mutable` with exact match provenance and default minimum `asserted` (#123782/#123793). Channels declare per-identifier strength; security audit warns on inert mutable entries (#131129). | | **Residual risk** | Medium - some channels remain vulnerable to spoofing | | **Recommendations** | Continue per-channel `verified` adoption and downstream strength mappers; document channel-specific risks | ## T-ACCESS-003: Token theft | Attribute | Value | | ----------------------- | ------------------------------------------------------------------ | | **ATLAS ID** | AML.T0040 - AI Model Inference API Access | | **Description** | Attacker steals authentication tokens from config/credential files | | **Attack vector** | Malware, unauthorized device access, config backup exposure | | **Affected components** | Channel/provider credential storage, config storage | | **Current mitigations** | File permissions | | **Residual risk** | High - tokens stored in plaintext on disk | | **Recommendations** | Implement token encryption at rest, add token rotation |