Threat model for "SecureDrop"

Threat actor: Large Corporation

Defined in model.py:85

Threats

Threat Status Impact Likelihood Risk After mitigations
Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail THREAT163 accepted High High 12 high 12 high
DNS THREAT85 partially mitigated High Medium 9 high 9 high
Source submits identifying information THREAT88 partially mitigated High Medium 9 high 9 high
Source goes to wrong source interface onion URL THREAT89 partially mitigated High Medium 9 high 9 high
Attacker has temporary physical access to workstation laptop and can disassemble it THREATQW60 partially mitigated High Medium 9 high 9 high
Source visits torproject.org THREAT91 accepted Medium High 8 high 8 high
Source visits securedrop.org, freedom.press THREAT92 partially mitigated Medium High 8 high 8 high
SecureDrop server identification THREAT93 out of scope Medium High 8 high 8 high
Landing page source control is compromised THREAT57 inform High High 12 high 6 medium
Known vulnerability in any VM template THREATQW22 mitigated High High 12 high 6 medium
Source uses tor2web THREAT75 out of scope High Medium 9 high 6 medium
Source reveals that they are using securedrop/leaking documents THREAT76 partially mitigated High Medium 9 high 6 medium
Landing page DNS leaks from Securedrop/leaks-related subdomain THREAT59 inform Medium High 8 high 6 medium
Session management vulnerability in Journalist interface THREAT7 mitigated High Low 6 medium 6 medium
Malicious apt package installed at install-time or during updates THREAT36 mitigated High Low 6 medium 6 medium
Compromise package build servers THREAT51 mitigated High Low 6 medium 6 medium
News Organization network is compromised THREAT68 accepted Medium Medium 6 medium 6 medium
NTP THREAT105 accepted Medium Medium 6 medium 6 medium
Source activity is compromised via physical surveillance (e.g.: camera) THREAT131 partially mitigated Medium Medium 6 medium 6 medium
Source is already compromised by malware THREAT135 out of scope High Low 6 medium 6 medium
Source network being monitored THREAT136 partially mitigated Medium Medium 6 medium 6 medium
Vulnerability in the QubesOS management layer THREATQW27 transferred Medium Medium 6 medium 6 medium
Malicious VM template THREATQW28 mitigated High Low 6 medium 6 medium
Workstation laptop is seized/stolen THREATQW30 partially mitigated Medium Medium 6 medium 6 medium
Attacker has temporary physical access to workstation laptop THREATQW59 unmanaged High Low 6 medium 6 medium
Evil maid attack on the operating system THREATQW32 partially mitigated High Very Low 3 low 6 medium
Authentication vulnerability in Journalist interface THREAT13 mitigated High Low 6 medium 4 medium
SecureDrop.org compromised THREAT52 partially mitigated High Low 6 medium 4 medium
Attacker obtains code execution in any VM THREATQW36 partially mitigated High Low 6 medium 4 medium
Admin two-factor authentication device is lost or compromised THREAT1 Legacy (Tails/SVS) accepted Medium Low 4 medium 4 medium
Admin workstation backup stick is compromised THREAT2 accepted Medium Low 4 medium 4 medium
USB transfer device malware compromises Journalist Workstation THREAT143 Legacy (Tails/SVS) accepted Medium Low 4 medium 4 medium
Compromise admin's corporate (or personal) devices or accounts THREAT145 Legacy (Tails/SVS) partially mitigated Medium Low 4 medium 4 medium
SVS activity compromised physical surveillance (e.g.: video camera) THREAT154 Legacy (Tails/SVS) partially mitigated Medium Low 4 medium 4 medium
Source resides in geographical location with very low Tor usage THREAT155 accepted Medium Low 4 medium 4 medium
Source searches for SecureDrop on search engines THREAT156 accepted Medium Low 4 medium 4 medium
Journalist two-factor authentication device is lost or compromised THREAT157 Legacy (Tails/SVS) accepted Medium Low 4 medium 4 medium
Vulnerability introduced in provisioning code THREATQW15 partially mitigated High Medium 9 high 3 low
Submission interface is framed THREAT32 mitigated High Low 6 medium 3 low
Journalist interface is framed THREAT33 mitigated High Low 6 medium 3 low
APT server man-in-the-middle and replaying old packages THREAT53 partially mitigated High Low 6 medium 3 low
SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54 mitigated High Low 6 medium 3 low
Unknown vulnerability in a VM template THREATQW10 mitigated High Low 6 medium 3 low
Attacker obtains code execution in the sd-app VM THREATQW18 mitigated High Low 6 medium 3 low
Admin SSH Key is compromised THREAT3 Legacy (Tails/SVS) accepted High Very Low 3 low 3 low
Evil maid attack on bootloader THREATQW13 accepted High Very Low 3 low 3 low
Attacker obtains code execution in the Network VM THREATQW17 partially mitigated Low Low 2 low 3 low
Injection vulnerability in securedrop-client THREATQW9 mitigated High Medium 9 high 2 low
Attacker obtains code execution in the GPG VM THREATQW6 partially mitigated High Low 6 medium 2 low
Vulnerabilities/Compromise of Hardware Firewall THREAT48 mitigated Medium Low 4 medium 2 low
Vulnerability introduced in code dependency of provisioning code THREATQW2 avoided High Very Low 3 low 2 low
Landing page is unavailable THREAT62 out of scope Low Low 2 low 2 low
OSSEC and/or Journalist alert SMTP account credentials compromised THREAT69 partially mitigated Low Low 2 low 2 low
OSSEC and/or Journalist alert private key compromised THREAT70 partially mitigated Low Low 2 low 2 low
Attacker obtains code execution in the Firewall VM THREATQW4 partially mitigated Low Low 2 low 2 low
Attacks on the journalist corporate workstation (malware/seized/tampered) THREAT55 out of scope Unknown Unknown Unknown Unknown
Attacks on the journalist corporate network (monitored/tampered) THREAT164 unmanaged Unknown Unknown Unknown Unknown

Back to Threat Actors | Back to Summary