Scenario: Supply chain and dependencies

Defined in model.py:612

Source code is built, signed, published, and installed on the servers.

6 open threats, highest risk 9 high · 36 threats in all · 5 data flows · 6 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Sequence Diagram

sequenceDiagram
    participant SecureDrop_source_repository as SecureDrop source repository
    link SecureDrop_source_repository: Component @ component_SecureDrop_source_repository.html
    participant SecureDrop_release___package_build as SecureDrop release & package build
    link SecureDrop_release___package_build: Component @ component_SecureDrop_release___package_build.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html
    participant App_Server_APT_NTP_DNS as App Server APT/NTP/DNS
    link App_Server_APT_NTP_DNS: Component @ component_App_Server_APT_NTP_DNS.html
    participant Ubuntu_apt_repository as Ubuntu apt repository
    link Ubuntu_apt_repository: Component @ component_Ubuntu_apt_repository.html
    participant Tor_software as Tor software
    link Tor_software: Component @ component_Tor_software.html
    participant Source_Interface as Source Interface
    link Source_Interface: Component @ component_Source_Interface.html

    SecureDrop_source_repository->>SecureDrop_release___package_build: 1. Build from source
    SecureDrop_release___package_build->>FPF_apt_repository: 2. Publish packages
    FPF_apt_repository->>App_Server_APT_NTP_DNS: 3. Install / update
    Ubuntu_apt_repository->>App_Server_APT_NTP_DNS: 4. Ubuntu dependencies
    Tor_software->>Source_Interface: 5. Tor dependency

Show data flows

ID	Name	Source	Sink	Type
1	Build from source	SecureDrop source repository	SecureDrop release & package build	Request
2	Publish packages	SecureDrop release & package build	FPF apt repository	Request
3	Install / update	FPF apt repository	App Server APT/NTP/DNS	Request
4	Ubuntu dependencies	Ubuntu apt repository	App Server APT/NTP/DNS	Request
5	Tor dependency	Tor software	Source Interface	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Vulnerabilities maliciously introduced in python libraries THREAT86	SecureDrop source repository	partially mitigated	9 high	9 high	Dependencies are kept to a minimum and only commonly used dependencies are used in SecureDrop; Hashes of dependencies are stored in source control.; Python wheels rebuilt from source tarballs at debian package build time.
Supply chain attack on Python dependencies, e.g. developer of Python dependency uploads malicious source or binary release (either intentionally or accidentally), PSF PyPI is compromised THREATQW35	SecureDrop source repository	mitigated	9 high	9 high
Application-server DDoS THREAT148	Source Interface	accepted	8 high	8 high
Known exploitable vulnerabilities in Python or libraries used by SecureDrop THREAT34	SecureDrop source repository	mitigated	9 high	6 medium	Wheels shipped in deb package (i.e. no pip install -r requirements.txt in prod); Python dependencies are updated when a CVE is present; Python wheels rebuilt from source tarballs at debian package build time.
Known weakness in hidden service cryptography THREAT39	Tor software	accepted	9 high	6 medium	Use v3 onion services
Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT35	Tor software	mitigated	6 medium	6 medium	Nighly security update; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; HidServAuth token on journalist interface; HidServAuth token on SSH
Malicious apt package installed at install-time or during updates THREAT36	Ubuntu apt repository	mitigated	6 medium	6 medium	apt performs GPG signature verification as long as it's not explicitly disabled
Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT37	Tor software	partially mitigated	6 medium	6 medium	Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; SSH password auth disabled, requires key; Passphrases for journalists and admins are generated to be 7 word diceware; 2FA token required for login to admin or journalist interfaces
Unknown vulnerabilities in Python or libraries used by SecureDrop THREAT38	Source Interface	accepted	6 medium	6 medium	AppArmor on Tor; AppArmor on Apache; Use of grsecurity-hardened kernels on servers; Use of OSSEC monitoring software
Github is compomised THREAT50	SecureDrop source repository	accepted	6 medium	6 medium	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; Airgapped signing for release tags, public and controlled branches for development/release; 2FA required for SD maintainer GitHub accounts; All code is reviewed prior to merge; SecureDrop code is open source
Compromise package build servers THREAT51	SecureDrop release & package build	mitigated	6 medium	6 medium	All SecureDrop and tor releases (Release file and tag) signed with airgapped key
Admin modifies Source interface Application code THREAT104	Source Interface	accepted	6 medium	6 medium
App server processes submission in plaintext THREAT109	Source Interface	partially mitigated	6 medium	6 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Nighly reboot occurs to clear secrets stored in memory
Website fingerprinting of source interface THREAT137	Source Interface	transferred	6 medium	6 medium
Compromise wheel/package build machines THREATQW34	SecureDrop release & package build	mitigated	6 medium	6 medium
Source submits large / invalid messages THREAT166	Source Interface	mitigated	12 high	4 medium	Forms use WTForms validators; Source interface only available as a Tor onion service
File and resource vulnerability in Source interface THREAT25	Source Interface	mitigated	9 high	4 medium	No external URL redirection; Untrusted uploaded data is directly encrypted and not executed
Business logic vulnerability in Source interface THREAT24	Source Interface	mitigated	6 medium	4 medium	Simple source interface application logic
Authentication vulnerability in Source interface THREAT10	Source Interface	mitigated	4 medium	4 medium	Source codename is 7 word diceware passphrase; Source codenames stored hashed in the database; No source codename reset functionality; Sources instructed to delete journalist replies after they read them; Source account does not display their submitted documents
Access control vulnerability in Source interface THREAT11	Source Interface	mitigated	4 medium	4 medium	Source codename is 7 word diceware passphrase; Source interface: Has a single role; CSRF from Flask used; Apache autoindex module disabled
Data protection vulnerability in Source interface THREAT12	Source Interface	mitigated	4 medium	4 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Use of strong encryption key for encrypted documents; Logging off for source interface; Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Source interface THREAT16	Source Interface	mitigated	4 medium	4 medium	Source interface only available as a Tor onion service; Support for HTTPS on source interface
Session management vulnerability in Source interface THREAT19	Source Interface	mitigated	4 medium	4 medium	Use of Flask session management; Session timeout on both interfaces; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie
Malicious input vulnerability in Source interface THREAT20	Source Interface	mitigated	4 medium	4 medium	Tor security slider set to high; X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping
Failure to encrypt submissions as they are written to disk THREAT21	Source Interface	mitigated	4 medium	4 medium	Logging off for source interface
Error handling and logging vulnerability in Source interface THREAT22	Source Interface	mitigated	4 medium	4 medium	Debugging is disabled; Logging off for source interface
Malicious code introduced in SecureDrop repository THREAT28	SecureDrop source repository	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; Airgapped signing for release tags, public and controlled branches for development/release; 2FA required for SD maintainer GitHub accounts; All code is reviewed prior to merge; SecureDrop code is open source
Malicious code introduced in SecureDrop release THREAT29	SecureDrop release & package build	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; Airgapped signing for release tags, public and controlled branches for development/release; 2FA required for SD maintainer GitHub accounts; All code is reviewed prior to merge; SecureDrop code is open source
Submission interface is framed THREAT32	Source Interface	mitigated	6 medium	3 low	X-FRAME-OPTIONS DENY HTTP header
APT server man-in-the-middle and replaying old packages THREAT53	FPF apt repository	partially mitigated	6 medium	3 low	Valid-Until for apt packages
SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54	FPF apt repository	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; tag verified before building debian packages
Vulnerabilities maliciously introduced in APT packages THREAT159	Ubuntu apt repository	accepted	6 medium	3 low	SecureDrop uses as few apt packages as possible.; Only packages in the security channel get updates
Tor (now FPF) apt repo compromised THREAT44	FPF apt repository	mitigated	3 low	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key
Ubuntu APT Repo compromised THREAT45	Ubuntu apt repository	partially mitigated	3 low	3 low	apt performs GPG signature verification as long as it's not explicitly disabled
Web services vulnerability in Source interface THREAT30	Source Interface	mitigated	4 medium	2 low	Minimal information exposed on Source Interface API endpoints
Impersonation/clone of SecureDrop Instance to phish sources/journalists THREAT173	Source Interface	unmanaged	Unknown	Unknown

Back to Summary