Scenario: Updates, time & DNS

Defined in model.py:589

App server reaches package/time/DNS services via the monitor gateway.

3 open threats, highest risk 9 high · 13 threats in all · 6 data flows · 5 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_DNS_resolver_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DNS resolver";
            URL = "component_DNS_resolver.html";
            tooltip = "DNS resolver";
            margin = 0.02;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_NTP_server_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "NTP server";
            URL = "component_NTP_server.html";
            tooltip = "NTP server";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nAPT/NTP/DNS";
            URL = "component_Monitor_Server_APT_NTP_DNS.html";
            tooltip = "Monitor Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    component_App_Server_APT_NTP_DNS_Application_Server -> component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Proxy via monitor";    ]
    component_Monitor_Server_APT_NTP_DNS_Monitoring_Server -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Egress via\nfirewall";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Ubuntu_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Ubuntu apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "4. FPF apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_NTP_server_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "5. NTP";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_DNS_resolver_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "6. DNS";    ]
}

Sequence Diagram

sequenceDiagram
    participant App_Server_APT_NTP_DNS as App Server APT/NTP/DNS
    link App_Server_APT_NTP_DNS: Component @ component_App_Server_APT_NTP_DNS.html
    participant Monitor_Server_APT_NTP_DNS as Monitor Server APT/NTP/DNS
    link Monitor_Server_APT_NTP_DNS: Component @ component_Monitor_Server_APT_NTP_DNS.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Ubuntu_apt_repository as Ubuntu apt repository
    link Ubuntu_apt_repository: Component @ component_Ubuntu_apt_repository.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html
    participant NTP_server as NTP server
    link NTP_server: Component @ component_NTP_server.html
    participant DNS_resolver as DNS resolver
    link DNS_resolver: Component @ component_DNS_resolver.html

    App_Server_APT_NTP_DNS->>Monitor_Server_APT_NTP_DNS: 1. Proxy via monitor
    Monitor_Server_APT_NTP_DNS->>Dedicated_Hardware_Firewall: 2. Egress via firewall
    Dedicated_Hardware_Firewall->>Ubuntu_apt_repository: 3. Ubuntu apt
    Dedicated_Hardware_Firewall->>FPF_apt_repository: 4. FPF apt
    Dedicated_Hardware_Firewall->>NTP_server: 5. NTP
    Dedicated_Hardware_Firewall->>DNS_resolver: 6. DNS

Show data flows

ID	Name	Source	Sink	Type
1	Proxy via monitor	App Server APT/NTP/DNS	Monitor Server APT/NTP/DNS	Request
2	Egress via firewall	Monitor Server APT/NTP/DNS	Dedicated Hardware Firewall	Request
3	Ubuntu apt	Dedicated Hardware Firewall	Ubuntu apt repository	Request
4	FPF apt	Dedicated Hardware Firewall	FPF apt repository	Request
5	NTP	Dedicated Hardware Firewall	NTP server	Request
6	DNS	Dedicated Hardware Firewall	DNS resolver	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
DNS THREAT85	DNS resolver	partially mitigated	9 high	9 high	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor
Malicious apt package installed at install-time or during updates THREAT36	Ubuntu apt repository	mitigated	6 medium	6 medium	apt performs GPG signature verification as long as it's not explicitly disabled
NTP THREAT105	NTP server	accepted	6 medium	6 medium
Firewall not up to date THREAT47	Dedicated Hardware Firewall	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
Firewall logs are not monitored THREAT149	Dedicated Hardware Firewall	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	Dedicated Hardware Firewall	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
APT server man-in-the-middle and replaying old packages THREAT53	FPF apt repository	partially mitigated	6 medium	3 low	Valid-Until for apt packages
SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54	FPF apt repository	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; tag verified before building debian packages
Vulnerabilities maliciously introduced in APT packages THREAT159	Ubuntu apt repository	accepted	6 medium	3 low	SecureDrop uses as few apt packages as possible.; Only packages in the security channel get updates
Tor (now FPF) apt repo compromised THREAT44	FPF apt repository	mitigated	3 low	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key
Ubuntu APT Repo compromised THREAT45	Ubuntu apt repository	partially mitigated	3 low	3 low	apt performs GPG signature verification as long as it's not explicitly disabled
Vulnerabilities/Compromise of Hardware Firewall THREAT48	Dedicated Hardware Firewall	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	Dedicated Hardware Firewall	mitigated	4 medium	2 low	Restrictive iptables rules on servers

Back to Summary