Source goes to wrong source interface onion URL partially mitigated

THREAT89 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:1548

Risk: High impact × Medium likelihood = 9 high
After mitigations: High impact × Medium likelihood = 9 high (unchanged)

How statuses and scores work

An attacker or malicious administrator that compromises the organisation's landing page can change the Onion URL and direct sources to the attacker-controlled SecureDrop instance.

Threat actors: Nation State / Law Enforcement Large Corporation Malicious Administrator

Mitigations

Mitigation	Status
Landing page deployment guide explains some security best practices for the webserver hosting the onion URL MITIG103	implemented
Landing page must have HTTPS by default MITIG24	implemented
Landing page must have no mixed content MITIG25	implemented
No third party trackers, analytics, or ads on the landing page MITIG27	implemented
securedrop.org directory explains sources should compare the onion URL in the directory with the one on the news org page MITIG105	implemented

Possible further mitigations

Alerts sent to admins and FPF when onion URLs change on landing pages (from monitoring via multiple Tor circuits and physical locations) MITIG104 proposed
Landing pages instruct users to compare onion URLs MITIG106 proposed
FPF staff try to seek out and add SecureDrops found in the wild to the directory MITIG107 proposed

Residual risk

This will not prevent nation-state level MITM attacks on first load of SecureDrop Landing Page

Where it applies

Applies to 1 component in 1 scenario.

Source Tor Browser Source Area

Source discovery and OPSEC · Source Tor Browser

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Notes

Existing mitigations: Security recommendations for landing page: https://docs.securedrop.org/en/stable/deployment_practices.html (MITIG103), HTTPS required (MITIG24), no mixed content (MITIG25), no ads (MITIG27). SD directory explains that users should compare onion URLs from the directory with those found on the landing page (MITIG105). Further mitigations: FPF should augment the SecureDrop landing page scoring tool with functionality to monitor the integrity of the landing page from multiple locations accross the internet (MITIG104). Documentation should be updated to suggest users to visit SecureDrop onion URL (secrdrop5wyphb5x.onion) and compare landing page onion addresses from news organizations to those of the SecureDrop directory (MITIG106). FPF staff should seek out SecureDrops not currently in the directory and ensure they are added as quickly as possible (MITIG107). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.