Authentication vulnerability in Source interface mitigated

THREAT10 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:185

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

An adversary can access a source's account (and journalist responses) without source codename.

Threat actors: Any

Mitigations

Mitigation	Status
Source codename is 7 word diceware passphrase MITIG45	implemented
Source codenames stored hashed in the database MITIG122	implemented
No source codename reset functionality MITIG198	implemented
Sources instructed to delete journalist replies after they read them MITIG199	implemented
Source account does not display their submitted documents MITIG44	implemented

Possible further mitigations

2FA for source accounts MITIG123 proposed

Where it applies

Applies to 1 component in 2 scenarios.

Source Interface Application Server

Source submission · Source Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Submit over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Source\nInterface";    ]
    component_Source_Interface_Application_Server -> component_SecureDrop_Application_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hand to app";    ]
    component_SecureDrop_Application_Application_Server -> component_Encrypted_submission_store_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Encrypt & store";    ]
    component_SecureDrop_Application_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Record metadata";    ]
}

Supply chain and dependencies · Source Interface

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Notes

Existing mitigations: Source codenames are generated automatically: 7 word diceware passphrases (MITIG45). Source codenames are stored in the database hashed with unique salt using scrypt with an n-value of 14 (MITIG122). There is no password reset functionality (MITIG198). Sources are instructed to delete journalist replies after reading (MITIG199). Source login does not display information about prior submissions (deniability) (MITIG44). Further mitigations: All authentications or challenges should respond in the same average response time. TOTP could be used to allow 2-FA on source interface (MITIG123). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.