Scenario: Workstation: reading submissions

Defined in model.py:662

A journalist downloads, decrypts and opens submissions on the SecureDrop Workstation.

25 open threats, highest risk 6 medium · 54 threats in all · 10 data flows · 8 affected components

Data Flow Diagram

Sequence Diagram

Show data flows
ID Name Source Sink Type
1 Use the client Journalist sd-app (SecureDrop Client) Request
2 Journalist API request sd-app (SecureDrop Client) sd-proxy Request
3 Route via firewall sd-proxy sys-firewall Request
4 Route to network sys-firewall sys-net Request
5 Reach the Journalist Interface sys-net Journalist Interface Request
6 Encrypted submissions Journalist Interface sys-net Response to Reach the Journalist Interface
7 Relay to client sd-proxy sd-app (SecureDrop Client) Response to Journalist API request
8 Decrypt sd-app (SecureDrop Client) sd-gpg Request
9 Open a file sd-app (SecureDrop Client) sd-viewer (disposable VMs) Request
10 Send logs sd-app (SecureDrop Client) sd-log Request

Applicable threats

Threat Component Status Risk After mitigations Mitigations
Known vulnerability in any VM template THREATQW22 sd-app (SecureDrop Client) mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-gpg mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-log mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-proxy mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sd-viewer (disposable VMs) mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sys-firewall mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Known vulnerability in any VM template THREATQW22 sys-net mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Segmentation between Journalist and Source interfaces THREAT6 Journalist Interface partially mitigated 9 high 6 medium Apache configured to expose source interface only via app-source-ths and journalist interface via app-journo-aths
Attacker obtains code execution in proxy VM THREATQW23 sd-proxy mitigated 9 high 6 medium qrexec that proxies API requests and responses only to SecureDrop application server
Session management vulnerability in Journalist interface THREAT7 Journalist Interface mitigated 6 medium 6 medium Use of Flask session management; Session timeout on both interfaces; Journalist interface: Set-Cookie ^(.*)$ $;HttpOnly; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie; HidServAuth token on journalist interface
Malicious input vulnerability in Journalist interface THREAT8 Journalist Interface mitigated 6 medium 6 medium X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping; HidServAuth token on journalist interface
Malicious VM template THREATQW28 sd-app (SecureDrop Client) mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-gpg mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-log mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-proxy mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sd-viewer (disposable VMs) mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sys-firewall mitigated 6 medium 6 medium
Malicious VM template THREATQW28 sys-net mitigated 6 medium 6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-gpg partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-log partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-proxy partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sd-viewer (disposable VMs) partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sys-firewall partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 sys-net partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Admin error in provisioning of the workstation THREATQW31 sd-app (SecureDrop Client) inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-gpg inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-log inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-proxy inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sd-viewer (disposable VMs) inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sys-firewall inform 6 medium 6 medium
Admin error in provisioning of the workstation THREATQW31 sys-net inform 6 medium 6 medium
Plaintext submissions exfiltrated THREATQW40 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium sd-proxy has server hardcoded; sd-client running in non networked VM
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-app (SecureDrop Client) partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-gpg partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-log partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-proxy partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sd-viewer (disposable VMs) partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sys-firewall partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Vulnerability introduced to AppVMs via Template dependency THREATQW58 sys-net partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Authentication vulnerability in Journalist interface THREAT13 Journalist Interface mitigated 6 medium 4 medium Passphrases are stored salted and hashed; 2FA token required for login to admin or journalist interfaces; ATHS token for Journalist Interface and API; Passphrases for journalists and admins are generated to be 7 word diceware; Journalist logins are throttled; Routes login protected by default on journalist interface
Attacker obtains code execution in any VM THREATQW36 sd-app (SecureDrop Client) partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-gpg partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-log partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-proxy partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sd-viewer (disposable VMs) partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sys-firewall partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Attacker obtains code execution in any VM THREATQW36 sys-net partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Access control vulnerability in Journalist interface THREAT14 Journalist Interface mitigated 4 medium 4 medium Journalist interface is one big inbox (makes for simple logic); Only 2 roles in journalist / admin interface; CSRF from Flask used
Data protection vulnerability in Journalist interface THREAT15 Journalist Interface mitigated 4 medium 4 medium Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Journalist interface THREAT17 Journalist Interface mitigated 4 medium 4 medium Journalist interface only available as a Tor onion service
File and resource vulnerability in Journalist interface THREAT18 Journalist Interface partially mitigated 4 medium 4 medium No external URL redirection; Untrusted uploaded data is directly encrypted and not executed; Journalist guide has cursory explanation of malware risks
Error handling and logging vulnerability in Journalist interface THREAT26 Journalist Interface mitigated 4 medium 4 medium Debugging is disabled; Journalist interface: Sensitive information is not logged
Business Logic vulnerability in Journalist interface THREAT146 Journalist Interface partially mitigated 4 medium 4 medium Journalist interface business logic is simple
Journalist user performs malicious action under another user's account THREAT170 Journalist Interface out of scope 4 medium 4 medium 2FA token required for login to admin or journalist interfaces; Persistent storage FDE for Journalist Workstation
Information disclosure (Xen vulnerability) THREATQW21 sd-app (SecureDrop Client) accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-gpg accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-log accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-proxy accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sd-viewer (disposable VMs) accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sys-firewall accepted 4 medium 4 medium
Information disclosure (Xen vulnerability) THREATQW21 sys-net accepted 4 medium 4 medium
Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 sd-app (SecureDrop Client) partially mitigated 4 medium 4 medium sd-client running in non networked VM
Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 sd-proxy partially mitigated 4 medium 4 medium sd-client running in non networked VM
Attacker tampers with replies in sd-proxy THREATQW42 sd-proxy accepted 4 medium 4 medium
DMA executed from compromised network VM (in a system that lacks VT-d) THREATQW47 sys-net mitigated 3 low 4 medium
User error while operating the workstation THREATQW19 sd-app (SecureDrop Client) partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-gpg partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-log partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-proxy partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sd-viewer (disposable VMs) partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sys-firewall partially mitigated 9 high 3 low
User error while operating the workstation THREATQW19 sys-net partially mitigated 9 high 3 low
Journalist interface is framed THREAT33 Journalist Interface mitigated 6 medium 3 low X-FRAME-OPTIONS DENY HTTP header; HidServAuth token on journalist interface
Unknown vulnerability in a VM template THREATQW10 sd-app (SecureDrop Client) mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-gpg mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-log mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-proxy mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sd-viewer (disposable VMs) mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sys-firewall mitigated 6 medium 3 low grsecurity in all Debian templates
Unknown vulnerability in a VM template THREATQW10 sys-net mitigated 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-app (SecureDrop Client) accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-gpg accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-log accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-proxy accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sd-viewer (disposable VMs) accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sys-firewall accepted 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 sys-net accepted 6 medium 3 low grsecurity in all Debian templates
Attacker obtains code execution in the sd-app VM THREATQW18 sd-app (SecureDrop Client) mitigated 6 medium 3 low grsecurity in all Debian templates
Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 sd-viewer (disposable VMs) partially mitigated 3 low 3 low Use non-networked disposible VMs for opening all decrypted files.
Zip bomb THREATQW53 sd-app (SecureDrop Client) partially mitigated 3 low 3 low
Attacker obtains code execution in the Network VM THREATQW17 sys-net partially mitigated 2 low 3 low
Attacker obtains code execution in sd-viewer VM THREATQW1 sd-viewer (disposable VMs) partially mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.; sd-proxy has server hardcoded
MIME hander in sd-app doesn't handle submission format THREATQW8 sd-viewer (disposable VMs) mitigated 9 high 2 low
Injection vulnerability in securedrop-client THREATQW9 sd-app (SecureDrop Client) mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.
Macro executed in malicious office file THREATQW46 sd-viewer (disposable VMs) mitigated 9 high 2 low Use non-networked disposible VMs for opening all decrypted files.
Attacker obtains code execution in the GPG VM THREATQW6 sd-gpg partially mitigated 6 medium 2 low
GPG VM (sd-gpg) performs attacker file decryption THREATQW7 sd-gpg mitigated 6 medium 2 low
Web services vulnerability in Journalist interface THREAT82 Journalist Interface mitigated 4 medium 2 low Journalist interface business logic is simple; ATHS token for Journalist Interface and API
Attacker obtains code execution on sd-gpg VM THREATQW5 sd-gpg partially mitigated 4 medium 2 low
Journalist interface hidden service secret exfiltrated THREATQW39 sd-proxy partially mitigated 4 medium 2 low
Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use THREATQW67 sd-proxy partially mitigated 4 medium 2 low
Adversary exploits gzip parsing to get code execution THREATQW37 sd-app (SecureDrop Client) accepted 3 low 2 low sd-client running in non networked VM; grsecurity in all Debian templates
Large file DoS in client THREATQW57 sd-app (SecureDrop Client) partially mitigated 3 low 2 low Forms use WTForms validators
Journalist user marks all submissions as seen THREAT171 Journalist Interface out of scope 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-app (SecureDrop Client) accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-gpg accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-log accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-proxy accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sd-viewer (disposable VMs) accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sys-firewall accepted 2 low 2 low
DoS (Xen vulnerability) THREATQW3 sys-net accepted 2 low 2 low
Attacker obtains code execution in the Firewall VM THREATQW4 sys-firewall partially mitigated 2 low 2 low
Failure in mime handling in sd-viewer THREATQW45 sd-viewer (disposable VMs) partially mitigated 2 low 2 low Execute bit is dropped during server side archive/clientside unarchive process
Compromised VM spoofs log origin THREATQW56 sd-app (SecureDrop Client) accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-gpg accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-log accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-proxy accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sd-viewer (disposable VMs) accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sys-firewall accepted 2 low 2 low
Compromised VM spoofs log origin THREATQW56 sys-net accepted 2 low 2 low
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-app (SecureDrop Client) accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-gpg accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-log accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-proxy accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sd-viewer (disposable VMs) accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sys-firewall accepted Unknown Unknown
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 sys-net accepted Unknown Unknown
Code injection via messages into App render process THREATQW62 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Malicious message plaintext is stored in database THREATQW63 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Code injection via malicious attachments in App THREATQW64 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Malware via malicious attachments in App THREATQW65 sd-app (SecureDrop Client) unmanaged Unknown Unknown
Data loss because of risk mitigations like sanatization THREATQW66 sd-app (SecureDrop Client) unmanaged Unknown Unknown

Back to Summary