Scenario: Source discovery and OPSEC

Defined in model.py:601

How a source finds the instance and the pre-submission OPSEC surface.

10 open threats, highest risk 9 high · 34 threats in all · 5 data flows · 5 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Sequence Diagram

sequenceDiagram
    participant Source as Source
    link Source: Component @ component_Source.html
    participant Source_environment as Source environment
    link Source_environment: Component @ component_Source_environment.html
    participant SecureDrop_org_directory as SecureDrop.org directory
    link SecureDrop_org_directory: Component @ component_SecureDrop_org_directory.html
    participant Landing_page as Landing page
    link Landing_page: Component @ component_Landing_page.html
    participant Source_Tor_Browser as Source Tor Browser
    link Source_Tor_Browser: Component @ component_Source_Tor_Browser.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html

    Source->>Source_environment: 1. Research / browse
    Source_environment->>SecureDrop_org_directory: 2. Check directory
    Source_environment->>Landing_page: 3. Visit landing page
    Source->>Source_Tor_Browser: 4. Open Tor Browser
    Source_Tor_Browser->>Dedicated_Hardware_Firewall: 5. Connect to onion

Show data flows

ID	Name	Source	Sink	Type
1	Research / browse	Source	Source environment	Request
2	Check directory	Source environment	SecureDrop.org directory	Request
3	Visit landing page	Source environment	Landing page	Request
4	Open Tor Browser	Source	Source Tor Browser	Request
5	Connect to onion	Source Tor Browser	Dedicated Hardware Firewall	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail THREAT163	Source environment	accepted	12 high	12 high
DNS requests to news organization's subdomain for SecureDrop landing page, freedom.press, torproject.org Tor activity, SD submissions may be correlated THREAT73	Source environment	inform	12 high	9 high	Source guide contains some OPSEC considerations; Guidelines for OPSEC in the landing page
Source submits identifying information THREAT88	Source Tor Browser	partially mitigated	9 high	9 high	Journalist guide mentions that metadata should be removed from documents
Source goes to wrong source interface onion URL THREAT89	Source Tor Browser	partially mitigated	9 high	9 high	Landing page deployment guide explains some security best practices for the webserver hosting the onion URL; Landing page must have HTTPS by default; Landing page must have no mixed content; No third party trackers, analytics, or ads on the landing page; securedrop.org directory explains sources should compare the onion URL in the directory with the one on the news org page
DNS request to .onion address THREAT90	Source environment	partially mitigated	9 high	9 high	Firefox does not send DNS requests for onion addresses; .onion addresses not links on the landing page
Source visits torproject.org THREAT91	Source Tor Browser	accepted	8 high	8 high
Source visits securedrop.org, freedom.press THREAT92	Source Tor Browser	partially mitigated	8 high	8 high	Direct links to securedrop.org and freedom.press strongly discouraged on landing page
Landing page source control is compromised THREAT57	Landing page	inform	12 high	6 medium	Landing page deployment guide explains some security best practices for the webserver hosting the onion URL
Landing page host is compromised THREAT58	Landing page	inform	12 high	6 medium	Landing page deployment guide explains some security best practices for the webserver hosting the onion URL
Source uses tor2web THREAT75	Source Tor Browser	out of scope	9 high	6 medium	Warning displayed when Tor2Web headers are present
Source reveals that they are using securedrop/leaking documents THREAT76	Source environment	partially mitigated	9 high	6 medium	Guidelines for OPSEC in the landing page; Source guide contains some OPSEC considerations
Landing page DNS leaks from Securedrop/leaks-related subdomain THREAT59	Landing page	inform	8 high	6 medium	Landing page subdomains discouraged
Source codename compromised THREAT74	Source environment	partially mitigated	6 medium	6 medium	Source codename is 7 word diceware passphrase; Source interface describes that the source should memorize the codename; Source codenames stored hashed in the database; Source account does not display their submitted documents
Landing page TLS private key compromised THREAT122	Landing page	partially mitigated	6 medium	6 medium	Landing page deployment guide explains some security best practices for the webserver hosting the onion URL
QUANTUM-like attacks for Landing page THREAT123	Landing page	accepted	6 medium	6 medium
Source activity is compromised via physical surveillance (e.g.: camera) THREAT131	Source environment	partially mitigated	6 medium	6 medium	Guidelines for OPSEC in the landing page; Source guide contains some OPSEC considerations
Source is already compromised by malware THREAT135	Source environment	out of scope	6 medium	6 medium
Source network being monitored THREAT136	Source environment	partially mitigated	6 medium	6 medium	Source interface only available as a Tor onion service
Firewall not up to date THREAT47	Dedicated Hardware Firewall	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
User web traffic to SecureDrop landing page is logged THREAT60	Landing page	inform	8 high	4 medium	No logging on landing page
User web traffic to SecureDrop landing page is uses CDN and may be logged THREAT61	Landing page	inform	8 high	4 medium	Use of CDNs discouraged for landing page (not really a reasonable ask, we use CDNs on securedrop.org)
SecureDrop.org compromised THREAT52	SecureDrop.org directory	partially mitigated	6 medium	4 medium	securedrop.org directory explains sources should compare the onion URL in the directory with the one on the news org page
Source uses employer/corporate device THREAT78	Source environment	inform	6 medium	4 medium	Guidelines for OPSEC in the landing page; Source guide contains some OPSEC considerations
Tor network exploit THREAT77	Source Tor Browser	accepted	4 medium	4 medium
Firewall logs are not monitored THREAT149	Dedicated Hardware Firewall	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	Dedicated Hardware Firewall	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
Source resides in geographical location with very low Tor usage THREAT155	Source Tor Browser	accepted	4 medium	4 medium
Source searches for SecureDrop on search engines THREAT156	Source environment	accepted	4 medium	4 medium	Guidelines for OPSEC in the landing page; Source guide contains some OPSEC considerations
Tor browser exploit THREAT79	Source Tor Browser	accepted	3 low	3 low	Tor security slider set to high
Vulnerabilities/Compromise of Hardware Firewall THREAT48	Dedicated Hardware Firewall	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	Dedicated Hardware Firewall	mitigated	4 medium	2 low	Restrictive iptables rules on servers
Watering hole attack on client THREAT80	Source Tor Browser	mitigated	4 medium	2 low	Tor security slider set to high
Landing page is unavailable THREAT62	Landing page	out of scope	2 low	2 low
Landing page is framed THREAT63	Landing page	inform	2 low	1 low	Landing page: always append X-Frame-Options: DENY

Back to Summary