Threat model for "SecureDrop"

Component: sd-proxy

Defined in model.py:436

Networked VM that relays the client's Journalist API requests over Tor, using the Arti Tor client.

boundary: Workstation VMs

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Known vulnerability in any VM template THREATQW22 mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Attacker obtains code execution in proxy VM THREATQW23 mitigated 9 high 6 medium qrexec that proxies API requests and responses only to SecureDrop application server
Malicious VM template THREATQW28 mitigated 6 medium 6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Admin error in provisioning of the workstation THREATQW31 inform 6 medium 6 medium
Vulnerability introduced to AppVMs via Template dependency THREATQW58 partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Attacker obtains code execution in any VM THREATQW36 partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Information disclosure (Xen vulnerability) THREATQW21 accepted 4 medium 4 medium
Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 partially mitigated 4 medium 4 medium sd-client running in non networked VM
Attacker tampers with replies in sd-proxy THREATQW42 accepted 4 medium 4 medium
User error while operating the workstation THREATQW19 partially mitigated 9 high 3 low
Unknown vulnerability in a VM template THREATQW10 mitigated 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 accepted 6 medium 3 low grsecurity in all Debian templates
Journalist interface hidden service secret exfiltrated THREATQW39 partially mitigated 4 medium 2 low
Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use THREATQW67 partially mitigated 4 medium 2 low
DoS (Xen vulnerability) THREATQW3 accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 accepted 2 low 2 low
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 accepted Unknown Unknown

Scenarios Using This Component

Back to Components List | Back to Summary