What security threats can you spot in the "We Are Angry" system?

Threat modelling is about thinking like an attacker to find vulnerabilities in your system. It helps you understand how a system works, how data moves through it, and where things might go wrong.

I’ve created a task to help you practice using STRIDE to spot potential threats in a model system called “We Are Angry.” STRIDE stands for

  • Spoofing,
  • Tampering,
  • Repudiation,
  • Information disclosure,
  • Denial of service, and
  • Elevation of privilege.

It is a simple way to guide your thinking and explore different types of risks.

When I run threat modeling sessions, I often use my card game called Threat Agents to make it more engaging. Each card represents a type of attack or attacker, which helps spark ideas about how systems could be at risk. You can try it too if you want to explore threat modelling in a fun and structured way.


Your task:

Download and review the We Are Angry data flow diagram.

  1. Look at how data moves through the system. You can focus on the whole system or just one user flow.
  2. Identify three possible threats or attacks you could test for.
  3. Try to use three different STRIDE categories if you can.
  4. For each threat, explain what it is, where it targets in the diagram, and why it matters.

Post your findings as a reply to this thread. Once you have shared, read what others have posted. You might get new ideas for how you could find threats in your own systems.

Handy resources:


If you want to learn more about threat modeling and other practical ways to build security into your testing, check out my course Everyday Security Testing: A Practical Guide to Getting Started.

2 Likes

I’ve just started looking at this today. Fantastic activity! I’d love to collaborate with you on community stuff in future.

2 Likes

I’d love to collaborate too! It was great meeting you at MoTaCon :slight_smile:

Three STRIDE-based threat possibilities

Spoofing Identity

If traffic between Client App and Login Server is not encrypted (HTTP), an attacker could spoof the client by intercepting or replaying the AuthSvcToken or ReviewAuthToken.
This would allow impersonation without knowing the actual credentials.

Tampering

A Man-in-the-Middle attack could modify the login response or subsequent API calls.
For example, altering the ReviewAuthToken or injecting a different User ID in requests to gain elevated privileges.

Information Disclosure

Tokens and User IDs sent over plain HTTP could be captured by sniffing network traffic.
This exposes sensitive session tokens, enabling session hijacking

1 Like