USB transfer device malware compromises SVS mitigated Legacy (Tails/SVS)

THREAT129 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:2221

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

Potentially comprimising SVS airgap

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Use of airgapped SVS key MITIG10	implemented
SecureDrop install guide explains that physical hardware like speakers, microphones, network devices should be removed from airgap MITIG152 Legacy (Tails/SVS)	implemented

Possible further mitigations

Transfer devices should be regularly sanitized - e.g. after each use. MITIG154 Legacy (Tails/SVS) proposed

Where it applies

Applies to 1 component in 1 scenario.

Transfer Device Legacy (Tails/SVS)

Transfer & decrypt Legacy (Tails/SVS) · Transfer Device

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;

        style = "filled,dashed";

        fillcolor = "#c0392b";

        fontcolor = "white";

        class = "tagged highlighted";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Notes

Existing mitigations: SVS is airgapped (MITIG10). Admin guide states that radios and unecessary hardware be removed/disabled from the SVS (MITIG152). Further mitigations: Transfer devices should be regularly sanitized. Admin should be be instructed to schedule regular Transfer Device maintenance (wiping, passphrase change on personnel changes) (MITIG154). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.