Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) mitigated

THREAT35 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:608

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

Known vulnerabilities in the Tor protocol/packages may risk of fingerprinting/eavesdropping on communication or bypassing Tor Hidden Service authentication.

Threat actors: Any

Mitigations

Mitigation	Status
Nighly security update MITIG165	implemented
Use of grsecurity-hardened kernels on servers MITIG53	implemented
AppArmor on Tor MITIG1	implemented
AppArmor on Apache MITIG2	implemented
Use of OSSEC monitoring software MITIG5	implemented
HidServAuth token on journalist interface MITIG3	implemented
HidServAuth token on SSH MITIG4	optional

Possible further mitigations

Support for HTTPS on source interface MITIG6 optional
HTTPS on journalist interface MITIG166 proposed

Residual risk

In default configuration, SecureDrop's Source and Journalist interfaces do not use HTTPS

Where it applies

Applies to 1 component in 1 scenario.

Tor software External Services

Supply chain and dependencies · Tor software

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Notes

Existing mitigations: A cron job ensures that automatic nightly security updates are applied for OS packages, including Tor (MITIG165). Grsecurity/PaX linux patches prevent the exploitation of certain memory-corruption attacks (MITIG53). AppArmor profiles further reduce process capabilities through Mandatory Access Control (MITIG1, MITIG2). Ossec is used for intrusion detection/file integrity monitoring (MITIG5). Hidden Service authentication is used as a complementary authentication and only used for defense-in-depth/attack surface reduction (MITIG3, MITIG4). Further mitigations: Use/mandate HTTPS for both Source and Journalist interfaces (MITIG6, MITIG166). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.