Threat model for "SecureDrop"

Component: sd-viewer (disposable VMs)

Defined in model.py:446

Template for the non-networked disposable VMs that open submitted files.

boundary: Workstation VMs

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Known vulnerability in any VM template THREATQW22 mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Malicious VM template THREATQW28 mitigated 6 medium 6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Admin error in provisioning of the workstation THREATQW31 inform 6 medium 6 medium
Vulnerability introduced to AppVMs via Template dependency THREATQW58 partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Attacker obtains code execution in any VM THREATQW36 partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Information disclosure (Xen vulnerability) THREATQW21 accepted 4 medium 4 medium
User error while operating the workstation THREATQW19 partially mitigated 9 high 3 low
Unknown vulnerability in a VM template THREATQW10 mitigated 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 accepted 6 medium 3 low grsecurity in all Debian templates
Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 partially mitigated 3 low 3 low Use non-networked disposible VMs for opening all decrypted files.
Attacker obtains code execution in sd-viewer VM THREATQW1 partially mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.; sd-proxy has server hardcoded
MIME hander in sd-app doesn't handle submission format THREATQW8 mitigated 9 high 2 low
Macro executed in malicious office file THREATQW46 mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.
DoS (Xen vulnerability) THREATQW3 accepted 2 low 2 low
Failure in mime handling in sd-viewer THREATQW45 partially mitigated 2 low 2 low Execute bit is dropped during server side archive/clientside unarchive process
Compromised VM spoofs log origin THREATQW56 accepted 2 low 2 low
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 accepted Unknown Unknown

Scenarios Using This Component

Back to Components List | Back to Summary