Scenario: Source submission

Defined in model.py:482

Anonymous source submits over Tor; app encrypts and stores it.

5 open threats, highest risk 9 high · 30 threats in all · 5 data flows · 4 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Submit over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Source\nInterface";    ]
    component_Source_Interface_Application_Server -> component_SecureDrop_Application_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hand to app";    ]
    component_SecureDrop_Application_Application_Server -> component_Encrypted_submission_store_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Encrypt & store";    ]
    component_SecureDrop_Application_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Record metadata";    ]
}

Sequence Diagram

sequenceDiagram
    participant Source as Source
    link Source: Component @ component_Source.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Source_Interface as Source Interface
    link Source_Interface: Component @ component_Source_Interface.html
    participant SecureDrop_Application as SecureDrop Application
    link SecureDrop_Application: Component @ component_SecureDrop_Application.html
    participant Encrypted_submission_store as Encrypted submission store
    link Encrypted_submission_store: Component @ component_Encrypted_submission_store.html
    participant Metadata_DB as Metadata DB
    link Metadata_DB: Component @ component_Metadata_DB.html

    Source->>Dedicated_Hardware_Firewall: 1. Submit over Tor
    Dedicated_Hardware_Firewall->>Source_Interface: 2. Reach Source Interface
    Source_Interface->>SecureDrop_Application: 3. Hand to app
    SecureDrop_Application->>Encrypted_submission_store: 4. Encrypt & store
    SecureDrop_Application->>Metadata_DB: 5. Record metadata

Show data flows

ID	Name	Source	Sink	Type
1	Submit over Tor	Source	Dedicated Hardware Firewall	Request
2	Reach Source Interface	Dedicated Hardware Firewall	Source Interface	Request
3	Hand to app	Source Interface	SecureDrop Application	Request
4	Encrypt & store	SecureDrop Application	Encrypted submission store	Request
5	Record metadata	SecureDrop Application	Metadata DB	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Configuration vulnerability in Source interface THREAT5	SecureDrop Application	partially mitigated	9 high	9 high	Config managed by securedrop-client sdconfig CLI tool
Application-server DDoS THREAT148	Source Interface	accepted	8 high	8 high
Application server configuration error THREAT169	SecureDrop Application	partially mitigated	9 high	6 medium	Use of Ansible for configuration management for servers
Configuration vulnerability in Journalist interface THREAT9	SecureDrop Application	mitigated	6 medium	6 medium	Config managed by securedrop-client sdconfig CLI tool
Unknown vulnerabilities in Python or libraries used by SecureDrop THREAT38	Source Interface	accepted	6 medium	6 medium	AppArmor on Tor; AppArmor on Apache; Use of grsecurity-hardened kernels on servers; Use of OSSEC monitoring software
Admin modifies Source interface Application code THREAT104	Source Interface	accepted	6 medium	6 medium
Application server full of submissions THREAT108	Encrypted submission store	partially mitigated	6 medium	6 medium	SecureDrop submissions limited to 500 MB; Source interface only available as a Tor onion service; OSSEC alert sent when server almost full
App server processes submission in plaintext THREAT109	Source Interface	partially mitigated	6 medium	6 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Nighly reboot occurs to clear secrets stored in memory
Website fingerprinting of source interface THREAT137	Source Interface	transferred	6 medium	6 medium
Source submits large / invalid messages THREAT166	Source Interface	mitigated	12 high	4 medium	Forms use WTForms validators; Source interface only available as a Tor onion service
File and resource vulnerability in Source interface THREAT25	Source Interface	mitigated	9 high	4 medium	No external URL redirection; Untrusted uploaded data is directly encrypted and not executed
Firewall not up to date THREAT47	Dedicated Hardware Firewall	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
Business logic vulnerability in Source interface THREAT24	Source Interface	mitigated	6 medium	4 medium	Simple source interface application logic
Authentication vulnerability in Source interface THREAT10	Source Interface	mitigated	4 medium	4 medium	Source codename is 7 word diceware passphrase; Source codenames stored hashed in the database; No source codename reset functionality; Sources instructed to delete journalist replies after they read them; Source account does not display their submitted documents
Access control vulnerability in Source interface THREAT11	Source Interface	mitigated	4 medium	4 medium	Source codename is 7 word diceware passphrase; Source interface: Has a single role; CSRF from Flask used; Apache autoindex module disabled
Data protection vulnerability in Source interface THREAT12	Source Interface	mitigated	4 medium	4 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Use of strong encryption key for encrypted documents; Logging off for source interface; Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Source interface THREAT16	Source Interface	mitigated	4 medium	4 medium	Source interface only available as a Tor onion service; Support for HTTPS on source interface
Session management vulnerability in Source interface THREAT19	Source Interface	mitigated	4 medium	4 medium	Use of Flask session management; Session timeout on both interfaces; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie
Malicious input vulnerability in Source interface THREAT20	Source Interface	mitigated	4 medium	4 medium	Tor security slider set to high; X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping
Failure to encrypt submissions as they are written to disk THREAT21	Source Interface	mitigated	4 medium	4 medium	Logging off for source interface
Error handling and logging vulnerability in Source interface THREAT22	Source Interface	mitigated	4 medium	4 medium	Debugging is disabled; Logging off for source interface
HTTP security configuration vulnerability in Source interface THREAT23	SecureDrop Application	mitigated	4 medium	4 medium	Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Source interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self
HTTP security configuration vulnerability in Journalist interface THREAT27	SecureDrop Application	mitigated	4 medium	4 medium	Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Journalist interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self
Firewall logs are not monitored THREAT149	Dedicated Hardware Firewall	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	Dedicated Hardware Firewall	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
Submission interface is framed THREAT32	Source Interface	mitigated	6 medium	3 low	X-FRAME-OPTIONS DENY HTTP header
Web services vulnerability in Source interface THREAT30	Source Interface	mitigated	4 medium	2 low	Minimal information exposed on Source Interface API endpoints
Vulnerabilities/Compromise of Hardware Firewall THREAT48	Dedicated Hardware Firewall	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	Dedicated Hardware Firewall	mitigated	4 medium	2 low	Restrictive iptables rules on servers
Impersonation/clone of SecureDrop Instance to phish sources/journalists THREAT173	Source Interface	unmanaged	Unknown	Unknown

Back to Summary