Downgrade cef.js-bridge-registered and firmware.image-shipped Confirmed -> Inferred

Attribution debt from this session. Both rules emitted Confirmed on evidence
that was pattern-based, not proof-based, which is exactly what the ladder
exists to prevent.

cef.js-bridge-registered: fires on the literal string RegisterJsObject or
JavascriptObjectRepository in a PE. That proves the assembly references the
type. It does not prove the call is reached at runtime. Confidence now
Inferred. Promotion to Confirmed requires an IL call-graph trace (that IL
check is not run here).

firmware.image-shipped: fires when a file with a firmware extension has the
right magic bytes. That proves the file exists in that shape. It does not
prove the vendor updater LOADS it or that it is flashed without a signature
check. Confidence now Inferred. Invoke-TcpkFirmwarePlantProbe (K25) promotes
to Confirmed (dynamic) when the read is observed.

firmware.image-writable STAYS Confirmed. Both facts it rests on (file exists,
DACL grants non-admin write) are directly observed here. The description now
draws the line between what is proven (writable primitive) and what is
inference (unsigned flash outcome) explicitly.

Two Pester assertions updated to pin the new Confidence labels. One new
assertion in IoTCompanion.Tests pins firmware.image-shipped == Inferred for
every future run.

Author: V33RU

CHANGELOG.md

@@ -4,6 +4,28 @@ Release history for TCPK. Newest first.
 
 ## Unreleased
 
+**Attribution debt paid: `cef.js-bridge-registered` and `firmware.image-shipped` downgraded from
+Confirmed to Inferred.** Both rules emitted `Confirmed` on evidence that was pattern-based, not
+proof-based:
+
+- `cef.js-bridge-registered` fires when the literal string `RegisterJsObject` or
+  `JavascriptObjectRepository` appears in a PE. That proves the assembly references the type;
+  it does not prove the call is reached. Confidence is now Inferred. Promotion to Confirmed
+  requires an IL call-graph trace (`Invoke-TcpkDecompile` or the AI-verify layer).
+- `firmware.image-shipped` fires when a file with a firmware extension has the right magic
+  bytes. That proves the file exists in that shape; it does not prove the vendor updater loads
+  it, or that it is flashed without a signature check. Confidence is now Inferred.
+  `Invoke-TcpkFirmwarePlantProbe` (K25) promotes to Confirmed (dynamic) when the read is
+  observed.
+- `firmware.image-writable` STAYS Confirmed because both facts it rests on (file exists,
+  DACL grants non-admin write) are directly observed here. Description tightened so the
+  boundary between what is proven (writable primitive) and what is inference (unsigned flash
+  outcome) is on the page.
+
+Attribution ladder discipline: `Confirmed` is reserved for facts the rule directly observes,
+not for downstream framing the description implies. Two Pester tests updated to pin the new
+labels.
+
 **Test-TcpkUserRules (A54) - user-authored check format, phase 1.**
 
 Anyone can now add a detection without touching PowerShell. Drop a JSON rule into

TCPK/Public/Discovery/Test-TcpkCefSharp.ps1

@@ -12,8 +12,11 @@ function Test-TcpkCefSharp {
 
     Detected here, in one pass over each PE:
 
-      cef.js-bridge-registered   HIGH  RegisterJsObject or JavascriptObjectRepository.Register
-                                       is called. The renderer has a bridge into managed code.
+      cef.js-bridge-registered   HIGH Inferred  The literal string RegisterJsObject or
+                                       JavascriptObjectRepository appears in the assembly. That
+                                       is textual evidence of the API reference; a proven call
+                                       site requires an IL check that this rule does not run,
+                                       so Confidence is Inferred not Confirmed.
 
       cef.remote-debugging-enabled  HIGH   CefSettings.RemoteDebuggingPort is set. DevTools is
                                        reachable on localhost with no authentication, so any
@@ -32,10 +35,12 @@ function Test-TcpkCefSharp {
       cef.uses-cefsharp          INFO   Assembly references CefSharp but none of the flags
                                        above matched. Scoping only.
 
-    This is INFERENCE. String presence in an assembly proves the type is referenced, not that
-    it is reached at runtime. Confidence = Inferred on the config-flag rules and Confirmed on
-    the bridge-registered rule, since a call to RegisterJsObject in shipped IL is the observed
-    behaviour rather than a possibility.
+    This is INFERENCE. String presence in an assembly proves the assembly REFERENCES the type,
+    not that the call is reached at runtime. Every rule here emits Confidence = Inferred; an
+    IL check that traces from the type reference to an actual call site would justify
+    Confirmed, and it is not run here. The static Confirmed grade is reserved for facts the
+    file alone proves (a shipped firmware image existing on disk, a user-writable DACL); a
+    call-graph reachability claim is not one of those.
 
 .PARAMETER Path
     Install directory or a single .NET assembly.
@@ -87,20 +92,22 @@ function Test-TcpkCefSharp {
                 if (-not $seen.Add($key)) { continue }
                 $fileHadHigher = $true
                 New-TcpkFinding -Module 'discovery' -RuleId 'cef.js-bridge-registered' `
-                    -Severity 'HIGH' -Confidence 'Confirmed' `
-                    -Title "$($pe.Name) registers a JavaScript-to-native bridge ($api)" `
-                    -File $pe.FullName -Evidence "api=$api" `
+                    -Severity 'HIGH' -Confidence 'Inferred' `
+                    -Title "$($pe.Name) references the CefSharp JS-to-native bridge API ($api)" `
+                    -File $pe.FullName -Evidence "api=$api (string reference in the PE; call site not traced)" `
                     -Cwe @('CWE-749') `
-                    -Description ('The assembly calls into the CefSharp bridge that exposes .NET objects ' +
-                        'to the embedded browser. Every method on the registered object becomes callable ' +
-                        'from any JavaScript in any frame the renderer processes. If the browser loads any ' +
-                        'HTML that is not fully first-party (a help page, a payment redirect, a documentation ' +
-                        'iframe, a login redirect back from an IdP, or an XSS in vendor content) that code ' +
-                        'now runs against process-privileged .NET.') `
-                    -Fix ('Prefer JavascriptObjectRepository with async bindings and NameConverter set to a ' +
-                        'strict subset; register a purpose-built bridge object with only the methods you want ' +
-                        'to expose, not a domain type. Consider CEF ExtensionSettings and process-per-site to ' +
-                        'contain a compromised renderer.')
+                    -Description ('The assembly REFERENCES the CefSharp bridge that exposes .NET objects to ' +
+                        'the embedded browser. The literal API name (' + $api + ') is present in the PE, so ' +
+                        'the type is imported. This rule does NOT prove that the call is reached at runtime; ' +
+                        'that would require an IL call-graph trace. Confidence is Inferred until that IL check ' +
+                        'runs. If the call IS reached, every method on the registered bridge object becomes ' +
+                        'callable from any JavaScript the renderer processes: a documentation iframe, a login ' +
+                        'redirect back from an IdP, an XSS in vendor content, all reach process-privileged .NET.') `
+                    -Fix ('Confirm the call site with an IL decompiler (Invoke-TcpkDecompile) or the AI-verify ' +
+                        'layer, then: prefer JavascriptObjectRepository with async bindings and NameConverter ' +
+                        'set to a strict subset; register a purpose-built bridge with only the methods you want ' +
+                        'to expose, not a domain type; consider CEF ExtensionSettings and process-per-site so ' +
+                        'a compromised renderer is contained.')
                 break
             }
         }

TCPK/Public/Discovery/Test-TcpkFirmwareImages.ps1

@@ -99,22 +99,43 @@ function Test-TcpkFirmwareImages {
             }
         } catch { }
 
-        $sev = if ($writable) { 'HIGH' } else { 'MEDIUM' }
+        $sev  = if ($writable) { 'HIGH' } else { 'MEDIUM' }
         $rule = if ($writable) { 'firmware.image-writable' } else { 'firmware.image-shipped' }
+        # Attribution ladder: 'firmware.image-writable' is Confirmed because both facts it
+        # rests on (the file exists at this path, the DACL grants non-admin write) are
+        # directly observed by this rule. 'firmware.image-shipped' has only the file-exists
+        # fact directly observed; the claim that the vendor's updater LOADS it and flashes it
+        # without a signature check is inference. K25 Invoke-TcpkFirmwarePlantProbe promotes
+        # the shipped case to Confirmed (dynamic) when the read is observed.
+        $conf = if ($writable) { 'Confirmed' } else { 'Inferred' }
         $evParts = @("kind=$kind", "ext=$ext", "size=$len")
         if ($mismatch) { $evParts += 'header=missing' }
         if ($writable) { $evParts += 'writable-by-users=true' }
 
+        $desc = if ($writable) {
+            ('A firmware image is present in the install tree AND the resting DACL grants write ' +
+             'to a non-admin group. Both facts are directly observed here. The exploit outcome ' +
+             '(a modified image is flashed to the physical device on the next update) requires ' +
+             'the vendor updater to READ this file and to flash it without a signature check. ' +
+             'That second half is not proven by this rule; run Invoke-TcpkFirmwarePlantProbe ' +
+             '(K25) to confirm dynamically. Local write on a firmware image that the updater ' +
+             'does read and flash unsigned is the primitive Evil PLC and TRITON traced from an ' +
+             'engineering workstation into controller code.')
+        } else {
+            ('A firmware image is present in the install tree. Only this fact is directly ' +
+             'observed here (file exists, header magic matches). Whether the vendor updater ' +
+             'actually reads it at flash time, and whether it verifies a vendor signature over ' +
+             'the payload, is INFERENCE. Confidence is Inferred until Invoke-TcpkFirmwarePlantProbe ' +
+             '(K25) runs and reports a read by the updater PID, or Test-TcpkUpdateFlow (F02) ' +
+             'reports missing signature primitives near the update code path.')
+        }
+
         New-TcpkFinding -Module 'discovery' -RuleId $rule `
-            -Severity $sev -Confidence 'Confirmed' `
+            -Severity $sev -Confidence $conf `
             -Title "$($f.Name) is a device firmware image ($kind)" `
             -File $f.FullName -Evidence ($evParts -join ' ') `
             -Cwe @('CWE-494') `
-            -Description ('A firmware image sits inside the install tree. If the desktop tool that flashes ' +
-                'or updates a device reads its payload from this path without verifying a vendor signature, ' +
-                'local write on this file becomes remote code on the device. This is the exact seam Evil PLC ' +
-                'and TRITON traced from an engineering workstation into controller code.' +
-                $(if ($writable) { ' The resting DACL grants write to a non-admin group, so no elevation is needed to plant a modified image.' } else { '' })) `
+            -Description $desc `
             -Fix ('Verify a vendor signature on every image before it is transmitted to the device, and ' +
                 'restrict the image directory ACL to the installer identity (SYSTEM or the vendor service account). ' +
                 'A code-signed image the desktop tool refuses to flash on signature failure closes the whole class.')

TCPK/Tests/CefSharp.Tests.ps1

@@ -36,14 +36,17 @@ AfterAll {
 }
 
 Describe 'Test-TcpkCefSharp' {
-    It 'reports a bridge registration as HIGH Confirmed' {
+    It 'reports a bridge registration as HIGH Inferred (string presence, not proven call site)' {
+        # Attribution ladder: this rule sees the API name in the PE. It does not run an IL
+        # trace to prove the call is reached, so Confidence is Inferred. Promoting to Confirmed
+        # requires an IL call-graph check (Invoke-TcpkDecompile / AI-verify).
         InModuleScope TCPK -Parameters @{ p = $script:bridge } {
             param($p)
             $rows = @(Test-TcpkCefSharp -Path $p)
             $r = $rows | Where-Object { $_.RuleId -eq 'cef.js-bridge-registered' }
             $r | Should -Not -BeNullOrEmpty
             $r.Severity | Should -Be 'HIGH'
-            $r.Confidence | Should -Be 'Confirmed'
+            $r.Confidence | Should -Be 'Inferred'
         }
     }
 

TCPK/Tests/IoTCompanion.Tests.ps1

@@ -51,6 +51,15 @@ Describe 'Test-TcpkFirmwareImages' {
         $f[0].Evidence | Should -Match 'kind=UF2'
     }
 
+    It 'grades firmware.image-shipped as Inferred (file existence Confirmed, attack primitive is inference)' {
+        # Attribution ladder: this rule proves the file exists. It does not prove the vendor
+        # updater reads it or flashes it unsigned. Confidence is Inferred; Invoke-TcpkFirmwarePlantProbe (K25)
+        # promotes to Confirmed (dynamic) when the read is observed.
+        $f = @(Test-TcpkFirmwareImages -Path $script:work | Where-Object { $_.RuleId -eq 'firmware.image-shipped' })
+        $f.Count | Should -BeGreaterThan 0
+        foreach ($row in $f) { $row.Confidence | Should -Be 'Inferred' }
+    }
+
     It 'reports the ELF and the Intel HEX text file' {
         $rows = @(Test-TcpkFirmwareImages -Path $script:work)
         ($rows | Where-Object { $_.File -like '*firmware.elf' }).Evidence | Should -Match 'kind=ELF'