Threat actor: Nation State / Law Enforcement
Defined in model.py:85
Threats
| Threat | Status | Impact | Likelihood | Risk | After mitigations |
|---|---|---|---|---|---|
| Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail THREAT163 | accepted | High | High | 12 high | 12 high |
| DNS requests to news organization's subdomain for SecureDrop landing page, freedom.press, torproject.org Tor activity, SD submissions may be correlated THREAT73 | inform | High | High | 12 high | 9 high |
| DNS THREAT85 | partially mitigated | High | Medium | 9 high | 9 high |
| Source submits identifying information THREAT88 | partially mitigated | High | Medium | 9 high | 9 high |
| Source goes to wrong source interface onion URL THREAT89 | partially mitigated | High | Medium | 9 high | 9 high |
| DNS request to .onion address THREAT90 | partially mitigated | High | Medium | 9 high | 9 high |
| Attacker has temporary physical access to workstation laptop and can disassemble it THREATQW60 | partially mitigated | High | Medium | 9 high | 9 high |
| Source visits torproject.org THREAT91 | accepted | Medium | High | 8 high | 8 high |
| Source visits securedrop.org, freedom.press THREAT92 | partially mitigated | Medium | High | 8 high | 8 high |
| SecureDrop server identification THREAT93 | out of scope | Medium | High | 8 high | 8 high |
| Landing page source control is compromised THREAT57 | inform | High | High | 12 high | 6 medium |
| Known vulnerability in any VM template THREATQW22 | mitigated | High | High | 12 high | 6 medium |
| Known weakness in hidden service cryptography THREAT39 | accepted | High | Medium | 9 high | 6 medium |
| Source uses tor2web THREAT75 | out of scope | High | Medium | 9 high | 6 medium |
| Source reveals that they are using securedrop/leaking documents THREAT76 | partially mitigated | High | Medium | 9 high | 6 medium |
| Attacker obtains code execution in proxy VM THREATQW23 | mitigated | High | Medium | 9 high | 6 medium |
| Landing page DNS leaks from Securedrop/leaks-related subdomain THREAT59 | inform | Medium | High | 8 high | 6 medium |
| Session management vulnerability in Journalist interface THREAT7 | mitigated | High | Low | 6 medium | 6 medium |
| Malicious apt package installed at install-time or during updates THREAT36 | mitigated | High | Low | 6 medium | 6 medium |
| Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT37 | partially mitigated | High | Low | 6 medium | 6 medium |
| Unknown vulnerabilities in Python or libraries used by SecureDrop THREAT38 | accepted | High | Low | 6 medium | 6 medium |
| Github is compomised THREAT50 | accepted | High | Low | 6 medium | 6 medium |
| Compromise package build servers THREAT51 | mitigated | High | Low | 6 medium | 6 medium |
| News Organization network is compromised THREAT68 | accepted | Medium | Medium | 6 medium | 6 medium |
| Airgapped SVS malware THREAT72 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium |
| Admin laptop seized THREAT94 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| Admin laptop tampered THREAT95 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Admin laptop supply chain attack THREAT96 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| Admin Tails USB stick tampered THREAT97 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| App server supply chain attack THREAT99 | inform | High | Low | 6 medium | 6 medium |
| Admin laptop seized while powered on THREAT100 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Admin Tails Persistent Volume passphrase compromised THREAT101 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium |
| Admin Tails workstation firmware compromised THREAT102 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| Admin activity compromised physical surveillance (e.g.: video camera) THREAT103 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| NTP THREAT105 | accepted | Medium | Medium | 6 medium | 6 medium |
| Admin key sent by (smail) mail and intercepted THREAT106 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| App server (physical) tampering THREAT107 | partially mitigated | High | Low | 6 medium | 6 medium |
| App server processes submission in plaintext THREAT109 | partially mitigated | High | Low | 6 medium | 6 medium |
| Firmware exploits/ME exploits for application server THREAT110 | accepted | High | Low | 6 medium | 6 medium |
| Journalist Tails workstation seized THREAT112 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Journalist Tails workstation seized while powered on THREAT113 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Journalist Tails workstation tampered THREAT114 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| Journalist Tails workstation supply chain attack THREAT115 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium |
| Journalist Tails workstation firmware compromised THREAT117 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| QUANTUM-like attacks for Landing page THREAT123 | accepted | High | Low | 6 medium | 6 medium |
| Monitor server is tampered THREAT124 | partially mitigated | High | Low | 6 medium | 6 medium |
| Monitor server supply chain attack THREAT125 | inform | High | Low | 6 medium | 6 medium |
| Airgapped SVS laptop seized while powered on THREAT127 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Exfiltration of SVS data through malicious documents THREAT128 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| USB transfer device malware compromises SVS THREAT129 Legacy (Tails/SVS) | mitigated | High | Low | 6 medium | 6 medium |
| Airgapped SVS laptop seized THREAT130 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium |
| Source activity is compromised via physical surveillance (e.g.: camera) THREAT131 | partially mitigated | Medium | Medium | 6 medium | 6 medium |
| Airgapped SVS supply chain attack THREAT132 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium |
| Airgapped SVS Tails key seized THREAT133 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium |
| Source is already compromised by malware THREAT135 | out of scope | High | Low | 6 medium | 6 medium |
| Source network being monitored THREAT136 | partially mitigated | Medium | Medium | 6 medium | 6 medium |
| Website fingerprinting of source interface THREAT137 | transferred | High | Low | 6 medium | 6 medium |
| Intel Firmware (incl. management engine vulnerability) THREATQW25 | transferred | High | Low | 6 medium | 6 medium |
| Supply chain attack on workstation hardware THREATQW26 | accepted | High | Low | 6 medium | 6 medium |
| Vulnerability in the QubesOS management layer THREATQW27 | transferred | Medium | Medium | 6 medium | 6 medium |
| Malicious VM template THREATQW28 | mitigated | High | Low | 6 medium | 6 medium |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 | partially mitigated | High | Low | 6 medium | 6 medium |
| Workstation laptop is seized/stolen THREATQW30 | partially mitigated | Medium | Medium | 6 medium | 6 medium |
| Attacker has temporary physical access to workstation laptop THREATQW59 | unmanaged | High | Low | 6 medium | 6 medium |
| Malicious or coerced administrator THREATQW61 | accepted | High | Low | 6 medium | 6 medium |
| Evil maid attack on the operating system THREATQW32 | partially mitigated | High | Very Low | 3 low | 6 medium |
| Authentication vulnerability in Journalist interface THREAT13 | mitigated | High | Low | 6 medium | 4 medium |
| SecureDrop.org compromised THREAT52 | partially mitigated | High | Low | 6 medium | 4 medium |
| Attacker obtains code execution in any VM THREATQW36 | partially mitigated | High | Low | 6 medium | 4 medium |
| Admin two-factor authentication device is lost or compromised THREAT1 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium |
| Admin workstation backup stick is compromised THREAT2 | accepted | Medium | Low | 4 medium | 4 medium |
| Monitor server is compromised THREAT66 | accepted | Medium | Low | 4 medium | 4 medium |
| Tor network exploit THREAT77 | accepted | Medium | Low | 4 medium | 4 medium |
| USB transfer device malware compromises Journalist Workstation THREAT143 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium |
| Admin Tails USB stick lost/seized THREAT144 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium |
| Compromise admin's corporate (or personal) devices or accounts THREAT145 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium |
| App server seized THREAT147 | partially mitigated | Medium | Low | 4 medium | 4 medium |
| Hardware Firewall Supply chain attack THREAT150 | accepted | Medium | Low | 4 medium | 4 medium |
| Journalist workstation Tails Key seized THREAT151 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium |
| Monitor server is seized THREAT152 | partially mitigated | Medium | Low | 4 medium | 4 medium |
| Airgapped SVS Tails key tampered THREAT153 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium |
| SVS activity compromised physical surveillance (e.g.: video camera) THREAT154 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium |
| Source resides in geographical location with very low Tor usage THREAT155 | accepted | Medium | Low | 4 medium | 4 medium |
| Source searches for SecureDrop on search engines THREAT156 | accepted | Medium | Low | 4 medium | 4 medium |
| Journalist two-factor authentication device is lost or compromised THREAT157 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium |
| Information disclosure (Xen vulnerability) THREATQW21 | accepted | Medium | Low | 4 medium | 4 medium |
| Vulnerability introduced in provisioning code THREATQW15 | partially mitigated | High | Medium | 9 high | 3 low |
| Submission interface is framed THREAT32 | mitigated | High | Low | 6 medium | 3 low |
| Journalist interface is framed THREAT33 | mitigated | High | Low | 6 medium | 3 low |
| Unknown vulnerabilities in the Linux Kernel THREAT40 | partially mitigated | High | Low | 6 medium | 3 low |
| Tails ISO malicious THREAT42 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 3 low |
| Ubuntu ISO malicious THREAT43 | inform | High | Low | 6 medium | 3 low |
| APT server man-in-the-middle and replaying old packages THREAT53 | partially mitigated | High | Low | 6 medium | 3 low |
| SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54 | mitigated | High | Low | 6 medium | 3 low |
| No mitigation or revocation for compromised key THREAT172 | partially mitigated | High | Low | 6 medium | 3 low |
| Unknown vulnerability in a VM template THREATQW10 | mitigated | High | Low | 6 medium | 3 low |
| Privilege escalation (Xen vulnerability) THREATQW11 | accepted | High | Low | 6 medium | 3 low |
| Attacker obtains code execution in the sd-app VM THREATQW18 | mitigated | High | Low | 6 medium | 3 low |
| Admin SSH Key is compromised THREAT3 Legacy (Tails/SVS) | accepted | High | Very Low | 3 low | 3 low |
| Tor (now FPF) apt repo compromised THREAT44 | mitigated | High | Very Low | 3 low | 3 low |
| Ubuntu APT Repo compromised THREAT45 | partially mitigated | High | Very Low | 3 low | 3 low |
| Tor browser exploit THREAT79 | accepted | High | Very Low | 3 low | 3 low |
| Side-channel attacks on Airgapped SVS THREAT160 Legacy (Tails/SVS) | accepted | High | Very Low | 3 low | 3 low |
| CPU-based attacks THREATQW12 | accepted | High | Very Low | 3 low | 3 low |
| Evil maid attack on bootloader THREATQW13 | accepted | High | Very Low | 3 low | 3 low |
| Evil maid attack on firmware THREATQW14 | accepted | High | Very Low | 3 low | 3 low |
| Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 | partially mitigated | High | Very Low | 3 low | 3 low |
| Attacker obtains code execution in the Network VM THREATQW17 | partially mitigated | Low | Low | 2 low | 3 low |
| Injection vulnerability in securedrop-client THREATQW9 | mitigated | High | Medium | 9 high | 2 low |
| Admin's network being monitored THREAT4 Legacy (Tails/SVS) | mitigated | High | Low | 6 medium | 2 low |
| Attacker obtains code execution in the GPG VM THREATQW6 | partially mitigated | High | Low | 6 medium | 2 low |
| GPG VM (sd-gpg) performs attacker file decryption THREATQW7 | mitigated | High | Low | 6 medium | 2 low |
| Hyperthreading THREATQW54 | mitigated | High | Low | 6 medium | 2 low |
| Vulnerabilities/Compromise of Hardware Firewall THREAT48 | mitigated | Medium | Low | 4 medium | 2 low |
| Attacker exploits postfix THREAT67 | partially mitigated | Medium | Low | 4 medium | 2 low |
| Watering hole attack on client THREAT80 | mitigated | Medium | Low | 4 medium | 2 low |
| Vulnerability introduced in code dependency of provisioning code THREATQW2 | avoided | High | Very Low | 3 low | 2 low |
| Landing page is unavailable THREAT62 | out of scope | Low | Low | 2 low | 2 low |
| OSSEC and/or Journalist alert SMTP account credentials compromised THREAT69 | partially mitigated | Low | Low | 2 low | 2 low |
| OSSEC and/or Journalist alert private key compromised THREAT70 | partially mitigated | Low | Low | 2 low | 2 low |
| Journalist network being monitored THREAT161 Legacy (Tails/SVS) | partially mitigated | Low | Low | 2 low | 2 low |
| DoS (Xen vulnerability) THREATQW3 | accepted | Low | Low | 2 low | 2 low |
| Attacker obtains code execution in the Firewall VM THREATQW4 | partially mitigated | Low | Low | 2 low | 2 low |
| Attacks on the journalist corporate workstation (malware/seized/tampered) THREAT55 | out of scope | Unknown | Unknown | Unknown | Unknown |
| Physical access to server room THREAT84 | out of scope | Unknown | Unknown | Unknown | Unknown |
| Attacks on the journalist corporate network (monitored/tampered) THREAT164 | unmanaged | Unknown | Unknown | Unknown | Unknown |
| Qubes is backdoored THREATQW43 | accepted | Unknown | Unknown | Unknown | Unknown |