Scenario: Workstation: export and print

Defined in model.py:710

A journalist exports a submission to a USB drive or prints it.

17 open threats, highest risk 6 medium · 31 threats in all · 6 data flows · 5 affected components

Data Flow Diagram

Sequence Diagram

Show data flows
ID Name Source Sink Type
1 Choose export Journalist sd-app (SecureDrop Client) Request
2 Hand file to export VM sd-app (SecureDrop Client) sd-devices (export and print) Request
3 Attach USB device sys-usb sd-devices (export and print) Request
4 Write to drive sd-devices (export and print) Export Device Request
5 Preview in disposable VM sd-devices (export and print) sd-viewer (disposable VMs) Request
6 Send logs sd-devices (export and print) sd-log Request

Applicable threats

Threat Component Status Risk After mitigations Mitigations
Known vulnerability in any VM template THREATQW22 sd-app (SecureDrop Client) mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-devices (export and print) mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-log mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-viewer (disposable VMs) mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sys-usb mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Malicious VM template THREATQW28 sd-app (SecureDrop Client) mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-devices (export and print) mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-log mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-viewer (disposable VMs) mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sys-usb mitigated 6 medium 6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-devices (export and print) partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-log partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-viewer (disposable VMs) partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sys-usb partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Admin error in provisioning of the workstation THREATQW31 sd-app (SecureDrop Client) inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-devices (export and print) inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-log inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-viewer (disposable VMs) inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sys-usb inform 6 medium 6 medium
Plaintext submissions exfiltrated THREATQW40 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium sd-proxy has server hardcoded; sd-client running in non networked VM
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-devices (export and print) partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-log partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-viewer (disposable VMs) partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sys-usb partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Attacker obtains code execution in any VM THREATQW36 sd-app (SecureDrop Client) partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-devices (export and print) partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-log partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-viewer (disposable VMs) partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sys-usb partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Information disclosure (Xen vulnerability) THREATQW21 sd-app (SecureDrop Client) accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-devices (export and print) accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-log accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-viewer (disposable VMs) accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sys-usb accepted 4 medium 4 medium
Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 sd-app (SecureDrop Client) partially mitigated 4 medium 4 medium sd-client running in non networked VM
User error while operating the workstation THREATQW19 sd-app (SecureDrop Client) partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-devices (export and print) partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-log partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-viewer (disposable VMs) partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sys-usb partially mitigated 9 high 3 low
Unknown vulnerability in a VM template THREATQW10 sd-app (SecureDrop Client) mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-devices (export and print) mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-log mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-viewer (disposable VMs) mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sys-usb mitigated 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-app (SecureDrop Client) accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-devices (export and print) accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-log accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-viewer (disposable VMs) accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sys-usb accepted 6 medium 3 low grsecurity in all Debian templates
Attacker obtains code execution in the sd-app VM THREATQW18 sd-app (SecureDrop Client) mitigated 6 medium 3 low grsecurity in all Debian templates
Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 sd-viewer (disposable VMs) partially mitigated 3 low 3 low Use non-networked disposible VMs for opening all decrypted files.
Zip bomb THREATQW53 sd-app (SecureDrop Client) partially mitigated 3 low 3 low
Attacker obtains code execution in sd-viewer VM THREATQW1 sd-viewer (disposable VMs) partially mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.; sd-proxy has server hardcoded
MIME hander in sd-app doesn't handle submission format THREATQW8 sd-viewer (disposable VMs) mitigated 9 high 2 low
Injection vulnerability in securedrop-client THREATQW9 sd-app (SecureDrop Client) mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.
Macro executed in malicious office file THREATQW46 sd-viewer (disposable VMs) mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.
Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use THREATQW67 sd-devices (export and print) partially mitigated 4 medium 2 low
Adversary exploits gzip parsing to get code execution THREATQW37 sd-app (SecureDrop Client) accepted 3 low 2 low sd-client running in non networked VM; grsecurity in all Debian templates
Large file DoS in client THREATQW57 sd-app (SecureDrop Client) partially mitigated 3 low 2 low Forms use WTForms validators
DoS (Xen vulnerability) THREATQW3 sd-app (SecureDrop Client) accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-devices (export and print) accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-log accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-viewer (disposable VMs) accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sys-usb accepted 2 low 2 low
Failure in mime handling in sd-viewer THREATQW45 sd-viewer (disposable VMs) partially mitigated 2 low 2 low Execute bit is dropped during server side archive/clientside unarchive process
Compromised VM spoofs log origin THREATQW56 sd-app (SecureDrop Client) accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-devices (export and print) accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-log accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-viewer (disposable VMs) accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sys-usb accepted 2 low 2 low
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-app (SecureDrop Client) accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-devices (export and print) accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-log accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-viewer (disposable VMs) accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sys-usb accepted Unknown Unknown
Code injection via messages into App render process THREATQW62 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Malicious message plaintext is stored in database THREATQW63 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Code injection via malicious attachments in App THREATQW64 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Malware via malicious attachments in App THREATQW65 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Data loss because of risk mitigations like sanatization THREATQW66 sd-app (SecureDrop Client) unmanaged Unknown Unknown

Back to Summary