Matching rules

Which component properties each threat's requirements use. R marks a property the rule checks; R* marks a sub-item, negation, comparison or any-of (|) requirement. Highlighted threats apply to at least one component in a scenario. Part of the model internals.

Threats listed for named components, instead of matched by properties, have empty rows here (233 of 233). The threats × components matrix shows where they apply.

High impact
THREAT3 Admin SSH Key is compromised accepted Risk 3
THREAT4 Admin's network being monitored mitigated Risk 6
THREAT5 Configuration vulnerability in... partially mitigated Risk 9
THREAT6 Segmentation between Journalist and... partially mitigated Risk 9
THREAT7 Session management vulnerability in... mitigated Risk 6
THREAT8 Malicious input vulnerability in... mitigated Risk 6
THREAT13 Authentication vulnerability in... mitigated Risk 6
THREAT24 Business logic vulnerability in... mitigated Risk 6
THREAT25 File and resource vulnerability in... mitigated Risk 9
THREAT28 Malicious code introduced in... mitigated Risk 6
THREAT29 Malicious code introduced in... mitigated Risk 6
THREAT31 Firewall rule misconfiguration on... partially mitigated Risk 9
THREAT32 Submission interface is framed mitigated Risk 6
THREAT33 Journalist interface is framed mitigated Risk 6
THREAT34 Known exploitable vulnerabilities in... mitigated Risk 9
THREAT35 Known vulnerabilities in Tor (incl.... mitigated Risk 6
THREAT36 Malicious apt package installed at... mitigated Risk 6
THREAT37 Unknown vulnerabilities in Tor... partially mitigated Risk 6
THREAT38 Unknown vulnerabilities in Python or... accepted Risk 6
THREAT39 Known weakness in hidden service cryptography accepted Risk 9
THREAT40 Unknown vulnerabilities in the Linux Kernel partially mitigated Risk 6
THREAT41 Known vulnerabilities in the Linux... mitigated Risk 6
THREAT42 Tails ISO malicious inform Risk 6
THREAT43 Ubuntu ISO malicious inform Risk 6
THREAT44 Tor (now FPF) apt repo compromised mitigated Risk 3
THREAT45 Ubuntu APT Repo compromised partially mitigated Risk 3
THREAT50 Github is compomised accepted Risk 6
THREAT51 Compromise package build servers mitigated Risk 6
THREAT52 SecureDrop.org compromised partially mitigated Risk 6
THREAT53 APT server man-in-the-middle and... partially mitigated Risk 6
THREAT54 SecureDrop APT servers are... mitigated Risk 6
THREAT57 Landing page source control is compromised inform Risk 12
THREAT58 Landing page host is compromised inform Risk 12
THREAT65 Monitor server configuration error partially mitigated Risk 9
THREAT72 Airgapped SVS malware inform Risk 6
THREAT73 DNS requests to news organization's... inform Risk 12
THREAT74 Source codename compromised partially mitigated Risk 6
THREAT75 Source uses tor2web out of scope Risk 9
THREAT76 Source reveals that they are using... partially mitigated Risk 9
THREAT79 Tor browser exploit accepted Risk 3
THREAT85 DNS partially mitigated Risk 9
THREAT86 Vulnerabilities maliciously... partially mitigated Risk 9
THREAT87 Failure to sanitize documents partially mitigated Risk 9
THREAT88 Source submits identifying information partially mitigated Risk 9
THREAT89 Source goes to wrong source... partially mitigated Risk 9
THREAT90 DNS request to .onion address partially mitigated Risk 9
THREAT94 Admin laptop seized accepted Risk 6
THREAT95 Admin laptop tampered partially mitigated Risk 6
THREAT96 Admin laptop supply chain attack accepted Risk 6
THREAT97 Admin Tails USB stick tampered accepted Risk 6
THREAT99 App server supply chain attack inform Risk 6
THREAT100 Admin laptop seized while powered on partially mitigated Risk 6
THREAT101 Admin Tails Persistent Volume... inform Risk 6
THREAT102 Admin Tails workstation firmware compromised accepted Risk 6
THREAT103 Admin activity compromised physical... partially mitigated Risk 6
THREAT106 Admin key sent by (smail) mail and... partially mitigated Risk 6
THREAT107 App server (physical) tampering partially mitigated Risk 6
THREAT109 App server processes submission in plaintext partially mitigated Risk 6
THREAT110 Firmware exploits/ME exploits for... accepted Risk 6
THREAT112 Journalist Tails workstation seized partially mitigated Risk 6
THREAT113 Journalist Tails workstation seized... partially mitigated Risk 6
THREAT114 Journalist Tails workstation tampered accepted Risk 6
THREAT115 Journalist Tails workstation supply... inform Risk 6
THREAT116 Journalist workstation Tails key tampered accepted Risk 6
THREAT117 Journalist Tails workstation... partially mitigated Risk 6
THREAT118 Journalist Tails workstation... partially mitigated Risk 6
THREAT119 Journalist activity compromised... inform Risk 6
THREAT120 Failure to segregate Securedrop... partially mitigated Risk 6
THREAT122 Landing page TLS private key compromised partially mitigated Risk 6
THREAT123 QUANTUM-like attacks for Landing page accepted Risk 6
THREAT124 Monitor server is tampered partially mitigated Risk 6
THREAT125 Monitor server supply chain attack inform Risk 6
THREAT126 Submission key is moved to a... inform Risk 6
THREAT127 Airgapped SVS laptop seized while powered on partially mitigated Risk 6
THREAT128 Exfiltration of SVS data through... partially mitigated Risk 6
THREAT129 USB transfer device malware compromises SVS mitigated Risk 6
THREAT130 Airgapped SVS laptop seized accepted Risk 6
THREAT132 Airgapped SVS supply chain attack inform Risk 6
THREAT133 Airgapped SVS Tails key seized partially mitigated Risk 6
THREAT134 Airgapped SVS Tails Persistent... inform Risk 6
THREAT135 Source is already compromised by malware out of scope Risk 6
THREAT137 Website fingerprinting of source interface transferred Risk 6
THREAT159 Vulnerabilities maliciously... accepted Risk 6
THREAT160 Side-channel attacks on Airgapped SVS accepted Risk 3
THREAT162 Transfer device passphrase compromised inform Risk 6
THREAT163 Source googles for SecureDrop,... accepted Risk 12
THREAT166 Source submits large / invalid messages mitigated Risk 12
THREAT167 OSSEC rules configuration error on... partially mitigated Risk 9
THREAT168 SSH configuration error on application server partially mitigated Risk 9
THREAT169 Application server configuration error partially mitigated Risk 9
THREAT172 No mitigation or revocation for... partially mitigated Risk 6
THREATQW1 Attacker obtains code execution in... partially mitigated Risk 9
THREATQW2 Vulnerability introduced in code... avoided Risk 3
THREATQW6 Attacker obtains code execution in the GPG VM partially mitigated Risk 6
THREATQW7 GPG VM (sd-gpg) performs attacker... mitigated Risk 6
THREATQW8 MIME hander in sd-app doesn't handle... mitigated Risk 9
THREATQW9 Injection vulnerability in securedrop-client mitigated Risk 9
THREATQW10 Unknown vulnerability in a VM template mitigated Risk 6
THREATQW11 Privilege escalation (Xen vulnerability) accepted Risk 6
THREATQW12 CPU-based attacks accepted Risk 3
THREATQW13 Evil maid attack on bootloader accepted Risk 3
THREATQW14 Evil maid attack on firmware accepted Risk 3
THREATQW15 Vulnerability introduced in provisioning code partially mitigated Risk 9
THREATQW16 Side-channel analysis or... partially mitigated Risk 3
THREATQW18 Attacker obtains code execution in... mitigated Risk 6
THREATQW19 User error while operating the workstation partially mitigated Risk 9
THREATQW22 Known vulnerability in any VM template mitigated Risk 12
THREATQW23 Attacker obtains code execution in proxy VM mitigated Risk 9
THREATQW25 Intel Firmware (incl. management... transferred Risk 6
THREATQW26 Supply chain attack on workstation hardware accepted Risk 6
THREATQW28 Malicious VM template mitigated Risk 6
THREATQW29 Side-channel analysis or... partially mitigated Risk 6
THREATQW31 Admin error in provisioning of the... inform Risk 6
THREATQW32 Evil maid attack on the operating system partially mitigated Risk 3
THREATQW34 Compromise wheel/package build machines mitigated Risk 6
THREATQW35 Supply chain attack on Python... mitigated Risk 9
THREATQW36 Attacker obtains code execution in any VM partially mitigated Risk 6
THREATQW37 Adversary exploits gzip parsing to... accepted Risk 3
THREATQW40 Plaintext submissions exfiltrated partially mitigated Risk 6
THREATQW44 Vulnerability in Qubes RPC implementation accepted Risk 3
THREATQW46 Macro executed in malicious office file mitigated Risk 9
THREATQW47 DMA executed from compromised... mitigated Risk 3
THREATQW51 qrexec vulnerability accepted Risk 3
THREATQW52 open-in-dvm vulnerability accepted Risk 3
THREATQW54 Hyperthreading mitigated Risk 6
THREATQW55 Qubes RPC policy misconfiguration mitigated Risk 6
THREATQW58 Vulnerability introduced to AppVMs... partially mitigated Risk 6
THREATQW59 Attacker has temporary physical... unmanaged Risk 6
THREATQW60 Attacker has temporary physical... partially mitigated Risk 9
THREATQW61 Malicious or coerced administrator accepted Risk 6

Medium impact
THREAT1 Admin two-factor authentication... accepted Risk 4
THREAT2 Admin workstation backup stick is compromised accepted Risk 4
THREAT9 Configuration vulnerability in... mitigated Risk 6
THREAT10 Authentication vulnerability in... mitigated Risk 4
THREAT11 Access control vulnerability in... mitigated Risk 4
THREAT12 Data protection vulnerability in... mitigated Risk 4
THREAT14 Access control vulnerability in... mitigated Risk 4
THREAT15 Data protection vulnerability in... mitigated Risk 4
THREAT16 Communications vulnerability in... mitigated Risk 4
THREAT17 Communications vulnerability in... mitigated Risk 4
THREAT18 File and resource vulnerability in... partially mitigated Risk 4
THREAT19 Session management vulnerability in... mitigated Risk 4
THREAT20 Malicious input vulnerability in... mitigated Risk 4
THREAT21 Failure to encrypt submissions as... mitigated Risk 4
THREAT22 Error handling and logging... mitigated Risk 4
THREAT23 HTTP security configuration... mitigated Risk 4
THREAT26 Error handling and logging... mitigated Risk 4
THREAT27 HTTP security configuration... mitigated Risk 4
THREAT30 Web services vulnerability in Source... mitigated Risk 4
THREAT47 Firewall not up to date inform Risk 8
THREAT48 Vulnerabilities/Compromise of... mitigated Risk 4
THREAT49 Hardware Firewall Misconfiguration mitigated Risk 4
THREAT56 Journalist gets phished inform Risk 6
THREAT59 Landing page DNS leaks from... inform Risk 8
THREAT60 User web traffic to SecureDrop... inform Risk 8
THREAT61 User web traffic to SecureDrop... inform Risk 8
THREAT66 Monitor server is compromised accepted Risk 4
THREAT67 Attacker exploits postfix partially mitigated Risk 4
THREAT68 News Organization network is compromised accepted Risk 6
THREAT77 Tor network exploit accepted Risk 4
THREAT78 Source uses employer/corporate device inform Risk 6
THREAT80 Watering hole attack on client mitigated Risk 4
THREAT81 Transfer device seized/stolen/lost inform Risk 4
THREAT82 Web services vulnerability in... mitigated Risk 4
THREAT91 Source visits torproject.org accepted Risk 8
THREAT92 Source visits securedrop.org, freedom.press partially mitigated Risk 8
THREAT93 SecureDrop server identification out of scope Risk 8
THREAT98 Admin violates compartmentalisation procedure inform Risk 6
THREAT104 Admin modifies Source interface... accepted Risk 6
THREAT105 NTP accepted Risk 6
THREAT108 Application server full of submissions partially mitigated Risk 6
THREAT121 Journalist workstation Tails... inform Risk 6
THREAT131 Source activity is compromised via... partially mitigated Risk 6
THREAT136 Source network being monitored partially mitigated Risk 6
THREAT138 Unsanitized decrypted files are... partially mitigated Risk 8
THREAT139 Malware on transfer device breaks SVS airgap inform Risk 6
THREAT140 Additional software installed on... inform Risk 4
THREAT141 Backups inform Risk 4
THREAT142 SVS drive plugged into/mounted on... inform Risk 4
THREAT143 USB transfer device malware... accepted Risk 4
THREAT144 Admin Tails USB stick lost/seized partially mitigated Risk 4
THREAT145 Compromise admin's corporate (or... partially mitigated Risk 4
THREAT146 Business Logic vulnerability in... partially mitigated Risk 4
THREAT147 App server seized partially mitigated Risk 4
THREAT148 Application-server DDoS accepted Risk 8
THREAT149 Firewall logs are not monitored inform Risk 4
THREAT150 Hardware Firewall Supply chain attack accepted Risk 4
THREAT151 Journalist workstation Tails Key seized partially mitigated Risk 4
THREAT152 Monitor server is seized partially mitigated Risk 4
THREAT153 Airgapped SVS Tails key tampered accepted Risk 4
THREAT154 SVS activity compromised physical... partially mitigated Risk 4
THREAT155 Source resides in geographical... accepted Risk 4
THREAT156 Source searches for SecureDrop on... accepted Risk 4
THREAT157 Journalist two-factor authentication... accepted Risk 4
THREAT165 Airgap broken by documents being... inform Risk 8
THREAT170 Journalist user performs malicious... out of scope Risk 4
THREATQW5 Attacker obtains code execution on sd-gpg VM partially mitigated Risk 4
THREATQW21 Information disclosure (Xen vulnerability) accepted Risk 4
THREATQW27 Vulnerability in the QubesOS management layer transferred Risk 6
THREATQW30 Workstation laptop is seized/stolen partially mitigated Risk 6
THREATQW38 Journalist Interface credentials... partially mitigated Risk 4
THREATQW39 Journalist interface hidden service... partially mitigated Risk 4
THREATQW42 Attacker tampers with replies in sd-proxy accepted Risk 4
THREATQW50 split-gpg vulnerability in upstream Qubes accepted Risk 2
THREATQW67 Lingering files in VMs (sd-proxy,... partially mitigated Risk 4

Low impact
THREAT46 Transfer device tampered inform Risk 1
THREAT62 Landing page is unavailable out of scope Risk 2
THREAT63 Landing page is framed inform Risk 2
THREAT69 OSSEC and/or Journalist alert SMTP... partially mitigated Risk 2
THREAT70 OSSEC and/or Journalist alert... partially mitigated Risk 2
THREAT71 SMTP relay compromised partially mitigated Risk 2
THREAT158 Monitor server is down inform Risk 3
THREAT161 Journalist network being monitored partially mitigated Risk 2
THREAT171 Journalist user marks all submissions as seen out of scope Risk 2
THREATQW3 DoS (Xen vulnerability) accepted Risk 2
THREATQW4 Attacker obtains code execution in... partially mitigated Risk 2
THREATQW17 Attacker obtains code execution in... partially mitigated Risk 2
THREATQW45 Failure in mime handling in sd-viewer partially mitigated Risk 2
THREATQW53 Zip bomb partially mitigated Risk 3
THREATQW56 Compromised VM spoofs log origin accepted Risk 2
THREATQW57 Large file DoS in client partially mitigated Risk 3

Unknown impact
THREAT55 Attacks on the journalist corporate... out of scope Risk Unknown
THREAT64 News organization, journalist or... out of scope Risk Unknown
THREAT84 Physical access to server room out of scope Risk Unknown
THREAT164 Attacks on the journalist corporate... unmanaged Risk Unknown
THREAT173 Impersonation/clone of SecureDrop... unmanaged Risk Unknown
THREATQW43 Qubes is backdoored accepted Risk Unknown
THREATQW48 Inter-vm covert channels (e.g. CPU... accepted Risk Unknown
THREATQW62 Code injection via messages into App... unmanaged Risk Unknown
THREATQW63 Malicious message plaintext is... unmanaged Risk Unknown
THREATQW64 Code injection via malicious... unmanaged Risk Unknown
THREATQW65 Malware via malicious attachments in App unmanaged Risk Unknown
THREATQW66 Data loss because of risk... unmanaged Risk Unknown