Watering hole attack on client mitigated

THREAT80 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:1410

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Very Low likelihood = 2 low

An adversary may introduce malicious code on a compromised SecureDrop instance to deanonymize SecureDrop sources and learn their real IP (Freedom Hosting-like attack)

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Tor security slider set to high MITIG67	optional

Possible further mitigations

Landing pages instruct sources to disable Javascript MITIG234 proposed

Residual risk

An attacker could disable the warning that tells the source to disable JavaScript.

Where it applies

Applies to 1 component in 1 scenario.

Source Tor Browser Source Area

Source discovery and OPSEC · Source Tor Browser

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Notes

Existing mitigations: Sources are instructed to disable JavaScript. This is how watering hole attacks have been done by the FBI against other onion services, e.g. Freedom Hosting. See https://www.wired.com/2016/05/history-fbis-hacking/ for more details on that. (MITIG67). Further mitigations: Strong guidance on landing pages themselves to disable JavaScript in Tor Browser. (MITIG234). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.