Journalist interface hidden service secret exfiltrated partially mitigated

THREATQW39 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:3581

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Very Low likelihood = 2 low

How statuses and scores work

An attacker that has compromised sd-proxy will be able to exfiltrate the journalist interface Tor Hidden Service Secret. VM is networked, easier for attacker to exfiltrate secrets

Mitigations

No mitigations in place.

Residual risk

Exploiting a bug in tor process gets a foothold Exploiting bug in tor protocol, Misconfigurations or vulnerabilities in the Whonix tempalte

Related threats

This threat is part of: Attacker obtains code execution in proxy VM THREATQW23

Where it applies

Applies to 1 component in 1 scenario.

sd-proxy Workstation VMs

Workstation: reading submissions · sd-proxy

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_proxy_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-proxy";
                URL = "component_sd_proxy.html";
                tooltip = "sd-proxy";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;
            ]

            component_sys_firewall_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-firewall";
                URL = "component_sys_firewall.html";
                tooltip = "sys-firewall";
                margin = 0.02;
            ]

            component_sys_net_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-net";
                URL = "component_sys_net.html";
                tooltip = "sys-net";
                margin = 0.02;
            ]

        }

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Use the client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_proxy_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist API\nrequest";    ]
    component_sd_proxy_Workstation_VMs -> component_sys_firewall_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Route via\nfirewall";    ]
    component_sys_firewall_Workstation_VMs -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "4. Route to network";    ]
    component_sys_net_Workstation_VMs -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reach the\nJournalist Interface";    ]
    component_Journalist_Interface_Application_Server -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Encrypted\nsubmissions";    ]
    component_sd_proxy_Workstation_VMs -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "7. Relay to client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Decrypt";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "9. Open a file";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "10. Send logs";    ]
}

Notes

Existing mitigations: Hidservauth is in sd-proxy which is only used as ProxyVM, and not by any other VM in the system.

How this threat is matched

Listed for these components. A boundary covers every component inside it.