Malicious apt package installed at install-time or during updates mitigated
THREAT36
· Mitigated: Controls in place bring the risk down to an acceptable level.
· Defined in catalog.py:634
- Risk
- High impact × Low likelihood = 6 medium
- After mitigations
- High impact × Low likelihood = 6 medium (unchanged)
An attacker performs a man-in-the middle attack on apt repositories and injects malicious apt packages that are installed by the SecureDrop server, admin or developer.
Threat actors: Nation State / Law Enforcement Large Corporation
Mitigations
| Mitigation | Status |
|---|---|
| apt performs GPG signature verification as long as it's not explicitly disabled MITIG167 | implemented |
Possible further mitigations
- Apt traffic over Tor MITIG91 proposed
Residual risk
Supply chain attacks on rarely used debian dependencies - a compromised Debian developer key could push a bad binary release.
Where it applies
Applies to 1 component in 2 scenarios.
Updates, time & DNS · Ubuntu apt repository
Supply chain and dependencies · Ubuntu apt repository
Notes
Existing mitigations: apt does GPG signature verification of all packages as long as it's not explicitly disabled (MITIG167). Further mitigations: Consider moving all APT repositories over HTTPS or Tor to ensure authentication of the channel (MITIG91). Automated test for mitigation: No.
How this threat is matched
Listed for these components. A boundary covers every component inside it.