Threat-modeling the LAN sync in my wildlife app (as a beginner)
I'm new to programming & have been teaching myself security by building things and then poking at my own assumptions. This is a simple threat model for one feature of Wildlife Incident Handoff , it's an opensource Windows app for recording wildlife incidents and handing them off between people. Now the feature is LAN sync : I wanted to make it so two paired devices on the same local network can…
A beginner programmer has penned a threat model for a feature in their open-source wildlife incident-handoff app. The feature allows two devices on the same local network to exchange incident records directly, without relying on a cloud service. This is an experimental, opt-in feature that has not undergone independent review.
The main concern is protecting sensitive information such as animal locations and private contact details, which should not be leaked. The potential threat is eavesdropping, where someone on the same WiFi network could intercept the data. However, the data is encrypted using AES-256-GCM with a key that both devices agree on through the P-256 ECDH + HKDF protocol.
The keys used for encryption are long-lived, which means there is no forward secrecy unless the keys are rotated or re-paired. Impersonation is another risk - someone could pretend to be the other device. Each install has its own keypair and fingerprint to compare, which helps prevent impersonation on a hostile network. However, if people fail to compare fingerprints, impersonation could still occur.
The threat model also addresses the risk of stolen pairing codes. If someone learns the pairing code, they could try to pair the devices. The first device must manually approve every request, which requires careful attention from the human user.
Another potential threat is replay attacks, where someone records a message and sends it again later. Each message includes a counter, and old counters are rejected even after a restart.
The model also covers the possibility of an unpaired device asking for records, which the sync endpoint rejects. Even when sync is disabled, the network listener stays open, listening for pairing and sync requests. This listener remains open while the app is running. The app does not currently support attachments, and testing is limited to a few routers, VPNs, and corporate networks. A security review by an outside expert is also recommended.
The writer notes that their understanding of the app's "disabled" state has changed. In the app, "disabled" means it refuses requests, not that it stops listening. They plan to fix this so the listener only runs when sync is turned on. If anyone discovers a flaw, they are asked to report it through the repo's SECURITY.md, rather than opening a public issue.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.