Scenario: Journalist triage

Defined in model.py:510

Authenticated journalist browses and downloads encrypted submissions.

4 open threats, highest risk 6 medium · 20 threats in all · 4 data flows · 3 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Authenticate over\nTor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Journalist\nInterface";    ]
    component_Journalist_Interface_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. List sources";    ]
    component_Encrypted_submission_store_Application_Server -> actor_Journalist_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Download\nencrypted";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Journalist_Interface as Journalist Interface
    link Journalist_Interface: Component @ component_Journalist_Interface.html
    participant Metadata_DB as Metadata DB
    link Metadata_DB: Component @ component_Metadata_DB.html
    participant Encrypted_submission_store as Encrypted submission store
    link Encrypted_submission_store: Component @ component_Encrypted_submission_store.html

    Journalist->>Dedicated_Hardware_Firewall: 1. Authenticate over Tor
    Dedicated_Hardware_Firewall->>Journalist_Interface: 2. Reach Journalist Interface
    Journalist_Interface->>Metadata_DB: 3. List sources
    Encrypted_submission_store->>Journalist: 4. Download encrypted

Show data flows

ID	Name	Source	Sink	Type
1	Authenticate over Tor	Journalist	Dedicated Hardware Firewall	Request
2	Reach Journalist Interface	Dedicated Hardware Firewall	Journalist Interface	Request
3	List sources	Journalist Interface	Metadata DB	Request
4	Download encrypted	Encrypted submission store	Journalist	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Segmentation between Journalist and Source interfaces THREAT6	Journalist Interface	partially mitigated	9 high	6 medium	Apache configured to expose source interface only via app-source-ths and journalist interface via app-journo-aths
Session management vulnerability in Journalist interface THREAT7	Journalist Interface	mitigated	6 medium	6 medium	Use of Flask session management; Session timeout on both interfaces; Journalist interface: Set-Cookie ^(.*)$ $;HttpOnly; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie; HidServAuth token on journalist interface
Malicious input vulnerability in Journalist interface THREAT8	Journalist Interface	mitigated	6 medium	6 medium	X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping; HidServAuth token on journalist interface
Application server full of submissions THREAT108	Encrypted submission store	partially mitigated	6 medium	6 medium	SecureDrop submissions limited to 500 MB; Source interface only available as a Tor onion service; OSSEC alert sent when server almost full
Firewall not up to date THREAT47	Dedicated Hardware Firewall	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
Authentication vulnerability in Journalist interface THREAT13	Journalist Interface	mitigated	6 medium	4 medium	Passphrases are stored salted and hashed; 2FA token required for login to admin or journalist interfaces; ATHS token for Journalist Interface and API; Passphrases for journalists and admins are generated to be 7 word diceware; Journalist logins are throttled; Routes login protected by default on journalist interface
Access control vulnerability in Journalist interface THREAT14	Journalist Interface	mitigated	4 medium	4 medium	Journalist interface is one big inbox (makes for simple logic); Only 2 roles in journalist / admin interface; CSRF from Flask used
Data protection vulnerability in Journalist interface THREAT15	Journalist Interface	mitigated	4 medium	4 medium	Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Journalist interface THREAT17	Journalist Interface	mitigated	4 medium	4 medium	Journalist interface only available as a Tor onion service
File and resource vulnerability in Journalist interface THREAT18	Journalist Interface	partially mitigated	4 medium	4 medium	No external URL redirection; Untrusted uploaded data is directly encrypted and not executed; Journalist guide has cursory explanation of malware risks
Error handling and logging vulnerability in Journalist interface THREAT26	Journalist Interface	mitigated	4 medium	4 medium	Debugging is disabled; Journalist interface: Sensitive information is not logged
Business Logic vulnerability in Journalist interface THREAT146	Journalist Interface	partially mitigated	4 medium	4 medium	Journalist interface business logic is simple
Firewall logs are not monitored THREAT149	Dedicated Hardware Firewall	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	Dedicated Hardware Firewall	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
Journalist user performs malicious action under another user's account THREAT170	Journalist Interface	out of scope	4 medium	4 medium	2FA token required for login to admin or journalist interfaces; Persistent storage FDE for Journalist Workstation
Journalist interface is framed THREAT33	Journalist Interface	mitigated	6 medium	3 low	X-FRAME-OPTIONS DENY HTTP header; HidServAuth token on journalist interface
Vulnerabilities/Compromise of Hardware Firewall THREAT48	Dedicated Hardware Firewall	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	Dedicated Hardware Firewall	mitigated	4 medium	2 low	Restrictive iptables rules on servers
Web services vulnerability in Journalist interface THREAT82	Journalist Interface	mitigated	4 medium	2 low	Journalist interface business logic is simple; ATHS token for Journalist Interface and API
Journalist user marks all submissions as seen THREAT171	Journalist Interface	out of scope	2 low	2 low

Back to Summary