Threat model for "SecureDrop"

Component: Source Interface

Defined in model.py:130

Public Flask app on a Tor onion; sources submit here.

boundary: Application Server handles source identity is exposed is hardened is tor onion processes untrusted input runs app code uses network

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Application-server DDoS THREAT148 accepted 8 high 8 high
Unknown vulnerabilities in Python or libraries used by SecureDrop THREAT38 accepted 6 medium 6 medium AppArmor on Tor; AppArmor on Apache; Use of grsecurity-hardened kernels on servers; Use of OSSEC monitoring software
Admin modifies Source interface Application code THREAT104 accepted 6 medium 6 medium
App server processes submission in plaintext THREAT109 partially mitigated 6 medium 6 medium Secure Temporary Wrapper to stream submissions encrypted on disk; Nighly reboot occurs to clear secrets stored in memory
Website fingerprinting of source interface THREAT137 transferred 6 medium 6 medium
Source submits large / invalid messages THREAT166 mitigated 12 high 4 medium Forms use WTForms validators; Source interface only available as a Tor onion service
File and resource vulnerability in Source interface THREAT25 mitigated 9 high 4 medium No external URL redirection; Untrusted uploaded data is directly encrypted and not executed
Business logic vulnerability in Source interface THREAT24 mitigated 6 medium 4 medium Simple source interface application logic
Authentication vulnerability in Source interface THREAT10 mitigated 4 medium 4 medium Source codename is 7 word diceware passphrase; Source codenames stored hashed in the database; No source codename reset functionality; Sources instructed to delete journalist replies after they read them; Source account does not display their submitted documents
Access control vulnerability in Source interface THREAT11 mitigated 4 medium 4 medium Source codename is 7 word diceware passphrase; Source interface: Has a single role; CSRF from Flask used; Apache autoindex module disabled
Data protection vulnerability in Source interface THREAT12 mitigated 4 medium 4 medium Secure Temporary Wrapper to stream submissions encrypted on disk; Use of strong encryption key for encrypted documents; Logging off for source interface; Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Source interface THREAT16 mitigated 4 medium 4 medium Source interface only available as a Tor onion service; Support for HTTPS on source interface
Session management vulnerability in Source interface THREAT19 mitigated 4 medium 4 medium Use of Flask session management; Session timeout on both interfaces; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie
Malicious input vulnerability in Source interface THREAT20 mitigated 4 medium 4 medium Tor security slider set to high; X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping
Failure to encrypt submissions as they are written to disk THREAT21 mitigated 4 medium 4 medium Logging off for source interface
Error handling and logging vulnerability in Source interface THREAT22 mitigated 4 medium 4 medium Debugging is disabled; Logging off for source interface
Submission interface is framed THREAT32 mitigated 6 medium 3 low X-FRAME-OPTIONS DENY HTTP header
Web services vulnerability in Source interface THREAT30 mitigated 4 medium 2 low Minimal information exposed on Source Interface API endpoints
Impersonation/clone of SecureDrop Instance to phish sources/journalists THREAT173 unmanaged Unknown Unknown

Scenarios Using This Component

Back to Components List | Back to Summary