Malicious code introduced in SecureDrop release mitigated

THREAT29 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:508

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Very Low likelihood = 3 low

An attacker could masquerade a contribution or accidentally insert malicious code to subvert the application (e.g. backdoor, faulty logic ...)

Threat actors: Malicious developer Developer error

Mitigations

Mitigation	Status
All SecureDrop and tor releases (Release file and tag) signed with airgapped key MITIG46	implemented
Airgapped signing for release tags, public and controlled branches for development/release MITIG77	implemented
2FA required for SD maintainer GitHub accounts MITIG176	implemented
All code is reviewed prior to merge MITIG47	implemented
SecureDrop code is open source MITIG177	implemented

Possible further mitigations

Mandate all signed commits MITIG231 proposed
Use hardware-backed token for SSH key auth to Github MITIG232 proposed
Shard SecureDrop release key MITIG233 proposed

Where it applies

Applies to 1 component in 1 scenario.

SecureDrop release & package build External Services

Supply chain and dependencies · SecureDrop release & package build

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Notes

Existing mitigations: Signed code, signed releases (we sign the release tag with the airgap key) (MITIG46), develop (trunk for us) branch protection (MITIG77), 2-factor mandated (MITIG176), code owners, code reviews (MITIG47). External contributors and users may also audit the code (MITIG177). Further mitigations: Additional code reviewers. Mandate the use of hardware-backed GPG keys and GPG signing for all commits to the SecureDrop repository (MITIG231). Also consider using an additional hardware-backed token for SSH key (MITIG232). Split SecureDrop release key among multiple maintainers, require N-person rule for release (MITIG233). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.