Airgapped SVS supply chain attack inform Legacy (Tails/SVS)

THREAT132 · Inform: Handled by telling users how to protect themselves. · Defined in catalog.py:2272

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

An adversary intercepts shipment of the SVS hardware and implants malware in the firmware.

Threat actors: Nation State / Law Enforcement

Mitigations

No mitigations in place.

Possible further mitigations

Buy retail hardware where possible MITIG118 proposed
Inspect physical hardware for implants (not really possible in many cases) MITIG119 proposed

Residual risk

Candidate for further mitigation efforts

Where it applies

Applies to 1 component in 2 scenarios.

Secure Viewing Station Legacy (Tails/SVS) Airgapped Viewing Area

Transfer & decrypt Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;
        style = "dashed";
        class = "tagged";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Publish & export Legacy (Tails/SVS) · Secure Viewing Station

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Offline_Printer_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Offline Printer";
            URL = "component_Offline_Printer.html";
            tooltip = "Offline Printer (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Publishing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Publishing Area</i>>;
        ]

        component_Sanitized_submission_Publishing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Sanitized\nsubmission";
            URL = "component_Sanitized_submission.html";
            tooltip = "Sanitized submission";
            margin = 0.02;
        ]

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Export sanitized";    ]
    component_Export_Device_ -> component_Sanitized_submission_Publishing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. To publishing\narea";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Offline_Printer_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Print";    ]
}

Notes

Further mitigations: Admins encouraged to buy retail hardware where possible (MITIG118). Inform administrators to inspect/compare equipment as it is received (MITIG119). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.