Attacker has temporary physical access to workstation laptop unmanaged

THREATQW59 · Unmanaged: No decision has been made about this threat yet. · Defined in catalog.py:3843

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

An attacker could try to tamper the boot partition which is unencrypted (Evil Maid Attack). To do so, without physically pulling out the hard drive, there is the need to to boot from al alternative mediom or access some kind of pre boot shell. Currently, it could be possible to use the "rescue" shell integrated in systemd or, when GRUB is available, chainload another bootloader from a removable media via the GRUB Shell.

Threat actors: Nation State / Law Enforcement Large Corporation

Mitigations

Mitigation	Status
Use safeboot or qubes anti-evil-maid for measured boot (https://github.com/freedomofpress/securedrop-workstation/issues/602) MITIGQW50	proposed
Use coreboot on workstation MITIGQW9	proposed

Where it applies

Applies to 1 component in 1 scenario.

Workstation bootloader SecureDrop Workstation

Workstation: boot, provisioning and updates · Workstation bootloader

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

        }

        component_Qubes_OS_and_Xen_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Qubes OS and Xen";
            URL = "component_Qubes_OS_and_Xen.html";
            tooltip = "Qubes OS and Xen";
            margin = 0.02;
        ]

        component_Workstation_bootloader_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nbootloader";
            URL = "component_Workstation_bootloader.html";
            tooltip = "Workstation bootloader";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Workstation_firmware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nfirmware";
            URL = "component_Workstation_firmware.html";
            tooltip = "Workstation firmware";
            margin = 0.02;
        ]

        component_Workstation_hardware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nhardware";
            URL = "component_Workstation_hardware.html";
            tooltip = "Workstation hardware";
            margin = 0.02;
        ]

        component_Workstation_provisioning_code_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nprovisioning\ncode";
            URL = "component_Workstation_provisioning_code.html";
            tooltip = "Workstation provisioning code";
            margin = 0.02;
        ]

        component_dom0_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "dom0";
            URL = "component_dom0.html";
            tooltip = "dom0";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Workstation_hardware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "1. Power on";    ]
    component_Workstation_hardware_SecureDrop_Workstation -> component_Workstation_firmware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "2. Start firmware";    ]
    component_Workstation_firmware_SecureDrop_Workstation -> component_Workstation_bootloader_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "3. Load bootloader";    ]
    component_Workstation_bootloader_SecureDrop_Workstation -> component_Qubes_OS_and_Xen_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "4. Boot Qubes";    ]
    component_Qubes_OS_and_Xen_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "5. Start dom0";    ]
    actor_Administrator_ -> component_Workstation_provisioning_code_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "6. Install and\nconfigure";    ]
    component_Workstation_provisioning_code_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apply salt states";    ]
    component_dom0_SecureDrop_Workstation -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Provide secret\nkeys";    ]
    component_dom0_SecureDrop_Workstation -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "9. Fetch updates";    ]
    component_FPF_apt_repository_External_Services -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signed packages";    ]
}

Notes

Existing mitigations: BIOS Password currently endorsed in the documentation to prevent change in setting or boot order. Grub and rescue yet to be addressed. Further mitigations: https://github.com/freedomofpress/securedrop-workstation-security/issues/2.

How this threat is matched

Listed for these components. A boundary covers every component inside it.