Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) partially mitigated

THREAT37 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:652

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

Unknown vulnerabilities in Tor may lead to weaknesses in encryption or authentication when users communicate with Tor hidden services.

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Use of grsecurity-hardened kernels on servers MITIG53	implemented
AppArmor on Tor MITIG1	implemented
AppArmor on Apache MITIG2	implemented
Use of OSSEC monitoring software MITIG5	implemented
SSH password auth disabled, requires key MITIG20	implemented
Passphrases for journalists and admins are generated to be 7 word diceware MITIG49	implemented
2FA token required for login to admin or journalist interfaces MITIG19	implemented

Possible further mitigations

Use v3 onion services MITIG168 implemented
e2e encryption MITIG140 proposed

Residual risk

Risk is accepted.

Where it applies

Applies to 1 component in 1 scenario.

Tor software External Services

Supply chain and dependencies · Tor software

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Notes

In scope: No. Existing mitigations: grsecurity/PaX linux patches prevent the exploitation of certain memory-corruption attacks (MITIG53). AppArmor profiles further reduce process capabilities through Mandatory Access Control (MITIG1, MITIG2). OSSEC is used for intrusion detection/file integrity monitoring (MITIG5). Defense-in-depth will protect services exposed/relying on authenticated hidden services: SSH (key-based authentication) (MITIG20), Journalist Interface (username, passphrase, TOTP/Yubikey) (MITIG49, MITIG19). Further mitigations: Move to tor v3 onion services that support stronger algorithms authentication and encryption (SHA3/ed25519/curve25519 vs. RSA1024). https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt (MITIG168), use e2e (MITIG140). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.