Scenario: Workstation: boot, provisioning and updates

Defined in model.py:734

The workstation boots, is provisioned by an administrator, and keeps its VMs updated.

12 open threats, highest risk 9 high · 39 threats in all · 10 data flows · 8 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

        }

        component_Qubes_OS_and_Xen_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Qubes OS and Xen";
            URL = "component_Qubes_OS_and_Xen.html";
            tooltip = "Qubes OS and Xen";
            margin = 0.02;
        ]

        component_Workstation_bootloader_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nbootloader";
            URL = "component_Workstation_bootloader.html";
            tooltip = "Workstation bootloader";
            margin = 0.02;
        ]

        component_Workstation_firmware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nfirmware";
            URL = "component_Workstation_firmware.html";
            tooltip = "Workstation firmware";
            margin = 0.02;
        ]

        component_Workstation_hardware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nhardware";
            URL = "component_Workstation_hardware.html";
            tooltip = "Workstation hardware";
            margin = 0.02;
        ]

        component_Workstation_provisioning_code_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nprovisioning\ncode";
            URL = "component_Workstation_provisioning_code.html";
            tooltip = "Workstation provisioning code";
            margin = 0.02;
        ]

        component_dom0_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "dom0";
            URL = "component_dom0.html";
            tooltip = "dom0";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Workstation_hardware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "1. Power on";    ]
    component_Workstation_hardware_SecureDrop_Workstation -> component_Workstation_firmware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "2. Start firmware";    ]
    component_Workstation_firmware_SecureDrop_Workstation -> component_Workstation_bootloader_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "3. Load bootloader";    ]
    component_Workstation_bootloader_SecureDrop_Workstation -> component_Qubes_OS_and_Xen_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "4. Boot Qubes";    ]
    component_Qubes_OS_and_Xen_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "5. Start dom0";    ]
    actor_Administrator_ -> component_Workstation_provisioning_code_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "6. Install and\nconfigure";    ]
    component_Workstation_provisioning_code_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apply salt states";    ]
    component_dom0_SecureDrop_Workstation -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Provide secret\nkeys";    ]
    component_dom0_SecureDrop_Workstation -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "9. Fetch updates";    ]
    component_FPF_apt_repository_External_Services -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signed packages";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Workstation_hardware as Workstation hardware
    link Workstation_hardware: Component @ component_Workstation_hardware.html
    participant Workstation_firmware as Workstation firmware
    link Workstation_firmware: Component @ component_Workstation_firmware.html
    participant Workstation_bootloader as Workstation bootloader
    link Workstation_bootloader: Component @ component_Workstation_bootloader.html
    participant Qubes_OS_and_Xen as Qubes OS and Xen
    link Qubes_OS_and_Xen: Component @ component_Qubes_OS_and_Xen.html
    participant dom0 as dom0
    link dom0: Component @ component_dom0.html
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html
    participant Workstation_provisioning_code as Workstation provisioning code
    link Workstation_provisioning_code: Component @ component_Workstation_provisioning_code.html
    participant sd_gpg as sd-gpg
    link sd_gpg: Component @ component_sd_gpg.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html

    Journalist->>Workstation_hardware: 1. Power on
    Workstation_hardware->>Workstation_firmware: 2. Start firmware
    Workstation_firmware->>Workstation_bootloader: 3. Load bootloader
    Workstation_bootloader->>Qubes_OS_and_Xen: 4. Boot Qubes
    Qubes_OS_and_Xen->>dom0: 5. Start dom0
    Administrator->>Workstation_provisioning_code: 6. Install and configure
    Workstation_provisioning_code->>dom0: 7. Apply salt states
    dom0->>sd_gpg: 8. Provide secret keys
    dom0->>FPF_apt_repository: 9. Fetch updates
    FPF_apt_repository-->>dom0: 10. Signed packages

Show data flows

ID	Name	Source	Sink	Type
1	Power on	Journalist	Workstation hardware	Request
2	Start firmware	Workstation hardware	Workstation firmware	Request
3	Load bootloader	Workstation firmware	Workstation bootloader	Request
4	Boot Qubes	Workstation bootloader	Qubes OS and Xen	Request
5	Start dom0	Qubes OS and Xen	dom0	Request
6	Install and configure	Administrator	Workstation provisioning code	Request
7	Apply salt states	Workstation provisioning code	dom0	Request
8	Provide secret keys	dom0	sd-gpg	Request
9	Fetch updates	dom0	FPF apt repository	Request
10	Signed packages	FPF apt repository	dom0	Response to Fetch updates

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Attacker has temporary physical access to workstation laptop and can disassemble it THREATQW60	Workstation hardware	partially mitigated	9 high	9 high	Use safeboot or qubes anti-evil-maid for measured boot (https://github.com/freedomofpress/securedrop-workstation/issues/602); Use coreboot on workstation
Known vulnerability in any VM template THREATQW22	sd-gpg	mitigated	12 high	6 medium	Autoupdate all VMs; grsecurity in all Debian templates
Intel Firmware (incl. management engine vulnerability) THREATQW25	Workstation hardware	transferred	6 medium	6 medium
Supply chain attack on workstation hardware THREATQW26	Workstation hardware	accepted	6 medium	6 medium
Vulnerability in the QubesOS management layer THREATQW27	Qubes OS and Xen	transferred	6 medium	6 medium
Malicious VM template THREATQW28	sd-gpg	mitigated	6 medium	6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29	sd-gpg	partially mitigated	6 medium	6 medium	Use non-networked disposible VMs for opening all decrypted files.
Workstation laptop is seized/stolen THREATQW30	Workstation hardware	partially mitigated	6 medium	6 medium
Admin error in provisioning of the workstation THREATQW31	sd-gpg	inform	6 medium	6 medium
Vulnerability introduced to AppVMs via Template dependency THREATQW58	sd-gpg	partially mitigated	6 medium	6 medium	grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Attacker has temporary physical access to workstation laptop THREATQW59	Workstation bootloader	unmanaged	6 medium	6 medium	Use safeboot or qubes anti-evil-maid for measured boot (https://github.com/freedomofpress/securedrop-workstation/issues/602); Use coreboot on workstation
Malicious or coerced administrator THREATQW61	Workstation provisioning code	accepted	6 medium	6 medium
Evil maid attack on the operating system THREATQW32	Qubes OS and Xen	partially mitigated	3 low	6 medium	Qubes - full disk encryption
Attacker obtains code execution in any VM THREATQW36	sd-gpg	partially mitigated	6 medium	4 medium	Default Qubes-RPC deny policy; grsecurity in all Debian templates
Qubes RPC policy misconfiguration THREATQW55	dom0	mitigated	6 medium	4 medium	Default Qubes-RPC deny policy
Information disclosure (Xen vulnerability) THREATQW21	sd-gpg	accepted	4 medium	4 medium
Vulnerability introduced in provisioning code THREATQW15	Workstation provisioning code	partially mitigated	9 high	3 low
User error while operating the workstation THREATQW19	sd-gpg	partially mitigated	9 high	3 low
APT server man-in-the-middle and replaying old packages THREAT53	FPF apt repository	partially mitigated	6 medium	3 low	Valid-Until for apt packages
SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54	FPF apt repository	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; tag verified before building debian packages
Unknown vulnerability in a VM template THREATQW10	sd-gpg	mitigated	6 medium	3 low	grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11	sd-gpg	accepted	6 medium	3 low	grsecurity in all Debian templates
Tor (now FPF) apt repo compromised THREAT44	FPF apt repository	mitigated	3 low	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key
CPU-based attacks THREATQW12	Workstation hardware	accepted	3 low	3 low	Disabling hyperthreading (done by Qubes)
Evil maid attack on bootloader THREATQW13	Workstation bootloader	accepted	3 low	3 low
Evil maid attack on firmware THREATQW14	Workstation firmware	accepted	3 low	3 low
Vulnerability in Qubes RPC implementation THREATQW44	Qubes OS and Xen	accepted	3 low	3 low
qrexec vulnerability THREATQW51	Qubes OS and Xen	accepted	3 low	3 low
open-in-dvm vulnerability THREATQW52	Qubes OS and Xen	accepted	3 low	3 low
split-gpg vulnerability in upstream Qubes THREATQW50	Qubes OS and Xen	accepted	2 low	3 low
Attacker obtains code execution in the GPG VM THREATQW6	sd-gpg	partially mitigated	6 medium	2 low
GPG VM (sd-gpg) performs attacker file decryption THREATQW7	sd-gpg	mitigated	6 medium	2 low
Hyperthreading THREATQW54	Workstation hardware	mitigated	6 medium	2 low	Disabling hyperthreading (done by Qubes); Don't use intel CPUs
Attacker obtains code execution on sd-gpg VM THREATQW5	sd-gpg	partially mitigated	4 medium	2 low
Vulnerability introduced in code dependency of provisioning code THREATQW2	Workstation provisioning code	avoided	3 low	2 low
DoS (Xen vulnerability) THREATQW3	sd-gpg	accepted	2 low	2 low
Compromised VM spoofs log origin THREATQW56	sd-gpg	accepted	2 low	2 low
Qubes is backdoored THREATQW43	Qubes OS and Xen	accepted	Unknown	Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48	sd-gpg	accepted	Unknown	Unknown

Back to Summary