Threats
Every threat in the model, highest residual risk first. Select a column heading to sort by it. See how to read this model for what the statuses and scores mean.
| Components | Threat actors | ||||||
|---|---|---|---|---|---|---|---|
| Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail THREAT163 | accepted | High | High | 12 high | 12 high | Source environment | Nation State / Law Enforcement, Large Corporation |
| DNS requests to news organization's subdomain for SecureDrop landing page, freedom.press, torproject.org Tor activity, SD submissions may be correlated THREAT73 | inform | High | High | 12 high | 9 high | Source environment | Nation State / Law Enforcement |
| Configuration vulnerability in Source interface THREAT5 | partially mitigated | High | Medium | 9 high | 9 high | SecureDrop Application | Any |
| DNS THREAT85 | partially mitigated | High | Medium | 9 high | 9 high | DNS resolver | Nation State / Law Enforcement, Large Corporation |
| Vulnerabilities maliciously introduced in python libraries THREAT86 | partially mitigated | High | Medium | 9 high | 9 high | SecureDrop source repository | Any |
| Failure to sanitize documents THREAT87 Legacy (Tails/SVS) | partially mitigated | High | Medium | 9 high | 9 high | Journalist Workstation (device) | Journalist error |
| Source submits identifying information THREAT88 | partially mitigated | High | Medium | 9 high | 9 high | Source Tor Browser | Nation State / Law Enforcement, Large Corporation, Source error |
| Source goes to wrong source interface onion URL THREAT89 | partially mitigated | High | Medium | 9 high | 9 high | Source Tor Browser | Nation State / Law Enforcement, Large Corporation, Malicious Administrator |
| DNS request to .onion address THREAT90 | partially mitigated | High | Medium | 9 high | 9 high | Source environment | Nation State / Law Enforcement |
| Supply chain attack on Python dependencies, e.g. developer of Python dependency uploads malicious source or binary release (either intentionally or accidentally), PSF PyPI is compromised THREATQW35 | mitigated | High | Medium | 9 high | 9 high | SecureDrop source repository | Troll |
| Attacker has temporary physical access to workstation laptop and can disassemble it THREATQW60 | partially mitigated | High | Medium | 9 high | 9 high | Workstation hardware | Nation State / Law Enforcement, Large Corporation |
| Source visits torproject.org THREAT91 | accepted | Medium | High | 8 high | 8 high | Source Tor Browser | Nation State / Law Enforcement, Large Corporation, ISP |
| Source visits securedrop.org, freedom.press THREAT92 | partially mitigated | Medium | High | 8 high | 8 high | Source Tor Browser | Nation State / Law Enforcement, Large Corporation, ISP |
| SecureDrop server identification THREAT93 | out of scope | Medium | High | 8 high | 8 high | Application Server (host), Monitoring Server (host) | Nation State / Law Enforcement, Large Corporation |
| Unsanitized decrypted files are transfered to journalist workstation without prior sanitization THREAT138 Legacy (Tails/SVS) | partially mitigated | Medium | High | 8 high | 8 high | Transfer Device | Journalist error |
| Application-server DDoS THREAT148 | accepted | Medium | High | 8 high | 8 high | Source Interface | Troll |
| Airgap broken by documents being decrypted on transfer device THREAT165 Legacy (Tails/SVS) | inform | Medium | High | 8 high | 8 high | Transfer Device | Journalist error |
| Landing page source control is compromised THREAT57 | inform | High | High | 12 high | 6 medium | Landing page | Nation State / Law Enforcement, Large Corporation |
| Landing page host is compromised THREAT58 | inform | High | High | 12 high | 6 medium | Landing page | Any |
| Known vulnerability in any VM template THREATQW22 | mitigated | High | High | 12 high | 6 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement, Large Corporation, Developer error |
| Segmentation between Journalist and Source interfaces THREAT6 | partially mitigated | High | Medium | 9 high | 6 medium | Journalist Interface | Developer error |
| Known exploitable vulnerabilities in Python or libraries used by SecureDrop THREAT34 | mitigated | High | Medium | 9 high | 6 medium | SecureDrop source repository | Any |
| Known weakness in hidden service cryptography THREAT39 | accepted | High | Medium | 9 high | 6 medium | Tor software | Nation State / Law Enforcement |
| Monitor server configuration error THREAT65 | partially mitigated | High | Medium | 9 high | 6 medium | Monitoring Server (host) | Administrator error |
| Source uses tor2web THREAT75 | out of scope | High | Medium | 9 high | 6 medium | Source Tor Browser | Nation State / Law Enforcement, Large Corporation |
| Source reveals that they are using securedrop/leaking documents THREAT76 | partially mitigated | High | Medium | 9 high | 6 medium | Source environment | Nation State / Law Enforcement, Large Corporation, Troll |
| OSSEC rules configuration error on application server THREAT167 | partially mitigated | High | Medium | 9 high | 6 medium | OSSEC client | Administrator error |
| SSH configuration error on application server THREAT168 | partially mitigated | High | Medium | 9 high | 6 medium | App Server SSH | Administrator error |
| Application server configuration error THREAT169 | partially mitigated | High | Medium | 9 high | 6 medium | SecureDrop Application | Administrator error |
| Attacker obtains code execution in proxy VM THREATQW23 | mitigated | High | Medium | 9 high | 6 medium | sd-proxy | Nation State / Law Enforcement |
| Landing page DNS leaks from Securedrop/leaks-related subdomain THREAT59 | inform | Medium | High | 8 high | 6 medium | Landing page | Nation State / Law Enforcement, Large Corporation, ISP |
| Session management vulnerability in Journalist interface THREAT7 | mitigated | High | Low | 6 medium | 6 medium | Journalist Interface | Nation State / Law Enforcement, Large Corporation |
| Malicious input vulnerability in Journalist interface THREAT8 | mitigated | High | Low | 6 medium | 6 medium | Journalist Interface | Any |
| Configuration vulnerability in Journalist interface THREAT9 | mitigated | Medium | Medium | 6 medium | 6 medium | SecureDrop Application | Any |
| Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT35 | mitigated | High | Low | 6 medium | 6 medium | Tor software | Any |
| Malicious apt package installed at install-time or during updates THREAT36 | mitigated | High | Low | 6 medium | 6 medium | Ubuntu apt repository | Nation State / Law Enforcement, Large Corporation |
| Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) THREAT37 | partially mitigated | High | Low | 6 medium | 6 medium | Tor software | Nation State / Law Enforcement |
| Unknown vulnerabilities in Python or libraries used by SecureDrop THREAT38 | accepted | High | Low | 6 medium | 6 medium | Source Interface | Nation State / Law Enforcement |
| Github is compomised THREAT50 | accepted | High | Low | 6 medium | 6 medium | SecureDrop source repository | Nation State / Law Enforcement |
| Compromise package build servers THREAT51 | mitigated | High | Low | 6 medium | 6 medium | SecureDrop release & package build | Nation State / Law Enforcement, Large Corporation |
| News Organization network is compromised THREAT68 | accepted | Medium | Medium | 6 medium | 6 medium | News Organization / Legal | Nation State / Law Enforcement, Large Corporation |
| Airgapped SVS malware THREAT72 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| Source codename compromised THREAT74 | partially mitigated | High | Low | 6 medium | 6 medium | Source environment | Any |
| Admin laptop seized THREAT94 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin laptop tampered THREAT95 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin laptop supply chain attack THREAT96 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin Tails USB stick tampered THREAT97 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin violates compartmentalisation procedure THREAT98 Legacy (Tails/SVS) | inform | Medium | Medium | 6 medium | 6 medium | Admin Workstation (device) | Administrator error |
| App server supply chain attack THREAT99 | inform | High | Low | 6 medium | 6 medium | Application Server (host) | Nation State / Law Enforcement |
| Admin laptop seized while powered on THREAT100 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin Tails Persistent Volume passphrase compromised THREAT101 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin Tails workstation firmware compromised THREAT102 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin activity compromised physical surveillance (e.g.: video camera) THREAT103 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Admin modifies Source interface Application code THREAT104 | accepted | Medium | Medium | 6 medium | 6 medium | Source Interface | Administrator error |
| NTP THREAT105 | accepted | Medium | Medium | 6 medium | 6 medium | NTP server | Nation State / Law Enforcement, Large Corporation |
| Admin key sent by (smail) mail and intercepted THREAT106 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| App server (physical) tampering THREAT107 | partially mitigated | High | Low | 6 medium | 6 medium | Application Server (host) | Nation State / Law Enforcement |
| Application server full of submissions THREAT108 | partially mitigated | Medium | Medium | 6 medium | 6 medium | Encrypted submission store | Troll |
| App server processes submission in plaintext THREAT109 | partially mitigated | High | Low | 6 medium | 6 medium | Source Interface | Nation State / Law Enforcement |
| Firmware exploits/ME exploits for application server THREAT110 | accepted | High | Low | 6 medium | 6 medium | Application Server (host) | Nation State / Law Enforcement |
| Journalist Tails workstation seized THREAT112 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist Tails workstation seized while powered on THREAT113 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist Tails workstation tampered THREAT114 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist Tails workstation supply chain attack THREAT115 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist workstation Tails key tampered THREAT116 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | |
| Journalist Tails workstation firmware compromised THREAT117 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist Tails workstation compromised by malware THREAT118 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | |
| Journalist activity compromised physical surveillance (e.g.: video camera) THREAT119 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Journalist Workstation (device) | |
| Failure to segregate Securedrop environment from corporate environment or personal environment THREAT120 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Admin Workstation (device), Journalist Workstation (device) | Journalist error |
| Journalist workstation Tails Persistent Volume passphrase compromised THREAT121 Legacy (Tails/SVS) | inform | Medium | Medium | 6 medium | 6 medium | Journalist Workstation (device) | Any |
| Landing page TLS private key compromised THREAT122 | partially mitigated | High | Low | 6 medium | 6 medium | Landing page | Any |
| QUANTUM-like attacks for Landing page THREAT123 | accepted | High | Low | 6 medium | 6 medium | Landing page | Nation State / Law Enforcement |
| Monitor server is tampered THREAT124 | partially mitigated | High | Low | 6 medium | 6 medium | Monitoring Server (host) | Nation State / Law Enforcement |
| Monitor server supply chain attack THREAT125 | inform | High | Low | 6 medium | 6 medium | Monitoring Server (host) | Nation State / Law Enforcement |
| Submission key is moved to a non-airgapped machine - journalist/admin workstation THREAT126 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Secure Viewing Station | Administrator error |
| Airgapped SVS laptop seized while powered on THREAT127 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| Exfiltration of SVS data through malicious documents THREAT128 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| USB transfer device malware compromises SVS THREAT129 Legacy (Tails/SVS) | mitigated | High | Low | 6 medium | 6 medium | Transfer Device | Nation State / Law Enforcement |
| Airgapped SVS laptop seized THREAT130 Legacy (Tails/SVS) | accepted | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| Source activity is compromised via physical surveillance (e.g.: camera) THREAT131 | partially mitigated | Medium | Medium | 6 medium | 6 medium | Source environment | Nation State / Law Enforcement, Large Corporation |
| Airgapped SVS supply chain attack THREAT132 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| Airgapped SVS Tails key seized THREAT133 Legacy (Tails/SVS) | partially mitigated | High | Low | 6 medium | 6 medium | Secure Viewing Station | Nation State / Law Enforcement |
| Airgapped SVS Tails Persistent Volume passphrase compromised THREAT134 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 6 medium | Secure Viewing Station | Administrator error |
| Source is already compromised by malware THREAT135 | out of scope | High | Low | 6 medium | 6 medium | Source environment | Nation State / Law Enforcement, Large Corporation |
| Source network being monitored THREAT136 | partially mitigated | Medium | Medium | 6 medium | 6 medium | Source environment | Nation State / Law Enforcement, Large Corporation, Source error |
| Website fingerprinting of source interface THREAT137 | transferred | High | Low | 6 medium | 6 medium | Source Interface | Nation State / Law Enforcement |
| Malware on transfer device breaks SVS airgap THREAT139 Legacy (Tails/SVS) | inform | Medium | Medium | 6 medium | 6 medium | Transfer Device | Journalist error |
| Intel Firmware (incl. management engine vulnerability) THREATQW25 | transferred | High | Low | 6 medium | 6 medium | Workstation hardware | Nation State / Law Enforcement |
| Supply chain attack on workstation hardware THREATQW26 | accepted | High | Low | 6 medium | 6 medium | Workstation hardware | Nation State / Law Enforcement |
| Vulnerability in the QubesOS management layer THREATQW27 | transferred | Medium | Medium | 6 medium | 6 medium | Qubes OS and Xen | Nation State / Law Enforcement, Large Corporation |
| Malicious VM template THREATQW28 | mitigated | High | Low | 6 medium | 6 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement, Large Corporation, Developer error |
| Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 | partially mitigated | High | Low | 6 medium | 6 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement |
| Workstation laptop is seized/stolen THREATQW30 | partially mitigated | Medium | Medium | 6 medium | 6 medium | Workstation hardware | Nation State / Law Enforcement, Large Corporation |
| Admin error in provisioning of the workstation THREATQW31 | inform | High | Low | 6 medium | 6 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Administrator error |
| Compromise wheel/package build machines THREATQW34 | mitigated | High | Low | 6 medium | 6 medium | SecureDrop release & package build | |
| Plaintext submissions exfiltrated THREATQW40 | partially mitigated | High | Low | 6 medium | 6 medium | sd-app (SecureDrop Client) | Any |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 | partially mitigated | High | Low | 6 medium | 6 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Any |
| Attacker has temporary physical access to workstation laptop THREATQW59 | unmanaged | High | Low | 6 medium | 6 medium | Workstation bootloader | Nation State / Law Enforcement, Large Corporation |
| Malicious or coerced administrator THREATQW61 | accepted | High | Low | 6 medium | 6 medium | Workstation provisioning code | Nation State / Law Enforcement |
| Evil maid attack on the operating system THREATQW32 | partially mitigated | High | Very Low | 3 low | 6 medium | Qubes OS and Xen | Nation State / Law Enforcement, Large Corporation |
| Source submits large / invalid messages THREAT166 | mitigated | High | High | 12 high | 4 medium | Source Interface | Any |
| File and resource vulnerability in Source interface THREAT25 | mitigated | High | Medium | 9 high | 4 medium | Source Interface | Any |
| Firewall not up to date THREAT47 | inform | Medium | High | 8 high | 4 medium | Dedicated Hardware Firewall | Any |
| User web traffic to SecureDrop landing page is logged THREAT60 | inform | Medium | High | 8 high | 4 medium | Landing page | Any |
| User web traffic to SecureDrop landing page is uses CDN and may be logged THREAT61 | inform | Medium | High | 8 high | 4 medium | Landing page | Any |
| Authentication vulnerability in Journalist interface THREAT13 | mitigated | High | Low | 6 medium | 4 medium | Journalist Interface | Nation State / Law Enforcement, Large Corporation |
| Business logic vulnerability in Source interface THREAT24 | mitigated | High | Low | 6 medium | 4 medium | Source Interface | Any |
| SecureDrop.org compromised THREAT52 | partially mitigated | High | Low | 6 medium | 4 medium | SecureDrop.org directory | Nation State / Law Enforcement, Large Corporation |
| Source uses employer/corporate device THREAT78 | inform | Medium | Medium | 6 medium | 4 medium | Source environment | Source error |
| Attacker obtains code execution in any VM THREATQW36 | partially mitigated | High | Low | 6 medium | 4 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement, Large Corporation, Developer error, Journalist error |
| Qubes RPC policy misconfiguration THREATQW55 | mitigated | High | Low | 6 medium | 4 medium | dom0 | |
| Admin two-factor authentication device is lost or compromised THREAT1 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium | Admin Workstation (device) | Nation State / Law Enforcement, Large Corporation |
| Admin workstation backup stick is compromised THREAT2 | accepted | Medium | Low | 4 medium | 4 medium | Backup / recovery media | Nation State / Law Enforcement, Large Corporation |
| Authentication vulnerability in Source interface THREAT10 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Access control vulnerability in Source interface THREAT11 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Data protection vulnerability in Source interface THREAT12 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Access control vulnerability in Journalist interface THREAT14 | mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| Data protection vulnerability in Journalist interface THREAT15 | mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| Communications vulnerability in Source interface THREAT16 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Communications vulnerability in Journalist interface THREAT17 | mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| File and resource vulnerability in Journalist interface THREAT18 | partially mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| Session management vulnerability in Source interface THREAT19 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Malicious input vulnerability in Source interface THREAT20 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Failure to encrypt submissions as they are written to disk THREAT21 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| Error handling and logging vulnerability in Source interface THREAT22 | mitigated | Medium | Low | 4 medium | 4 medium | Source Interface | Any |
| HTTP security configuration vulnerability in Source interface THREAT23 | mitigated | Medium | Low | 4 medium | 4 medium | SecureDrop Application | Any |
| Error handling and logging vulnerability in Journalist interface THREAT26 | mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| HTTP security configuration vulnerability in Journalist interface THREAT27 | mitigated | Medium | Low | 4 medium | 4 medium | SecureDrop Application | Any |
| Monitor server is compromised THREAT66 | accepted | Medium | Low | 4 medium | 4 medium | Monitoring Server (host) | Nation State / Law Enforcement |
| Tor network exploit THREAT77 | accepted | Medium | Low | 4 medium | 4 medium | Source Tor Browser | Nation State / Law Enforcement |
| Transfer device seized/stolen/lost THREAT81 Legacy (Tails/SVS) | inform | Medium | Low | 4 medium | 4 medium | Transfer Device | Any |
| Additional software installed on Admin Workstation THREAT140 Legacy (Tails/SVS) | inform | Medium | Low | 4 medium | 4 medium | Admin Workstation (device) | Administrator error |
| Backups THREAT141 | inform | Medium | Low | 4 medium | 4 medium | Backup / recovery media | Any |
| SVS drive plugged into/mounted on non-airgapped machine. THREAT142 Legacy (Tails/SVS) | inform | Medium | Low | 4 medium | 4 medium | Secure Viewing Station | Journalist error |
| USB transfer device malware compromises Journalist Workstation THREAT143 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium | Journalist Workstation (device) | Nation State / Law Enforcement, Large Corporation |
| Admin Tails USB stick lost/seized THREAT144 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium | Admin Workstation (device) | Nation State / Law Enforcement |
| Compromise admin's corporate (or personal) devices or accounts THREAT145 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium | Admin Workstation (device) | Nation State / Law Enforcement, Large Corporation |
| Business Logic vulnerability in Journalist interface THREAT146 | partially mitigated | Medium | Low | 4 medium | 4 medium | Journalist Interface | Any |
| App server seized THREAT147 | partially mitigated | Medium | Low | 4 medium | 4 medium | Application Server (host) | Nation State / Law Enforcement |
| Firewall logs are not monitored THREAT149 | inform | Medium | Low | 4 medium | 4 medium | Dedicated Hardware Firewall | Any |
| Hardware Firewall Supply chain attack THREAT150 | accepted | Medium | Low | 4 medium | 4 medium | Dedicated Hardware Firewall | Nation State / Law Enforcement |
| Journalist workstation Tails Key seized THREAT151 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium | Journalist Workstation (device) | Nation State / Law Enforcement |
| Monitor server is seized THREAT152 | partially mitigated | Medium | Low | 4 medium | 4 medium | Monitoring Server (host) | Nation State / Law Enforcement |
| Airgapped SVS Tails key tampered THREAT153 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium | Secure Viewing Station | Nation State / Law Enforcement |
| SVS activity compromised physical surveillance (e.g.: video camera) THREAT154 Legacy (Tails/SVS) | partially mitigated | Medium | Low | 4 medium | 4 medium | Secure Viewing Station | Nation State / Law Enforcement, Large Corporation |
| Source resides in geographical location with very low Tor usage THREAT155 | accepted | Medium | Low | 4 medium | 4 medium | Source Tor Browser | Nation State / Law Enforcement, Large Corporation |
| Source searches for SecureDrop on search engines THREAT156 | accepted | Medium | Low | 4 medium | 4 medium | Source environment | Nation State / Law Enforcement, Large Corporation |
| Journalist two-factor authentication device is lost or compromised THREAT157 Legacy (Tails/SVS) | accepted | Medium | Low | 4 medium | 4 medium | Journalist Workstation (device) | Nation State / Law Enforcement, Large Corporation |
| Journalist user performs malicious action under another user's account THREAT170 | out of scope | Medium | Low | 4 medium | 4 medium | Journalist Interface | Malicious journalist |
| Information disclosure (Xen vulnerability) THREATQW21 | accepted | Medium | Low | 4 medium | 4 medium | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement |
| Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token THREATQW38 | partially mitigated | Medium | Low | 4 medium | 4 medium | sd-app (SecureDrop Client), sd-proxy | |
| Attacker tampers with replies in sd-proxy THREATQW42 | accepted | Medium | Low | 4 medium | 4 medium | sd-proxy | |
| DMA executed from compromised network VM (in a system that lacks VT-d) THREATQW47 | mitigated | High | Very Low | 3 low | 4 medium | sys-net | |
| Firewall rule misconfiguration on application server THREAT31 | partially mitigated | High | Medium | 9 high | 3 low | Application Server (host) | Administrator error |
| Vulnerability introduced in provisioning code THREATQW15 | partially mitigated | High | Medium | 9 high | 3 low | Workstation provisioning code | Nation State / Law Enforcement, Large Corporation, Developer error |
| User error while operating the workstation THREATQW19 | partially mitigated | High | Medium | 9 high | 3 low | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Journalist error |
| Malicious code introduced in SecureDrop repository THREAT28 | mitigated | High | Low | 6 medium | 3 low | SecureDrop source repository | Malicious developer, Developer error |
| Malicious code introduced in SecureDrop release THREAT29 | mitigated | High | Low | 6 medium | 3 low | SecureDrop release & package build | Malicious developer, Developer error |
| Submission interface is framed THREAT32 | mitigated | High | Low | 6 medium | 3 low | Source Interface | Nation State / Law Enforcement, Large Corporation |
| Journalist interface is framed THREAT33 | mitigated | High | Low | 6 medium | 3 low | Journalist Interface | Nation State / Law Enforcement, Large Corporation |
| Unknown vulnerabilities in the Linux Kernel THREAT40 | partially mitigated | High | Low | 6 medium | 3 low | Application Server (host), Monitoring Server (host) | Nation State / Law Enforcement |
| Known vulnerabilities in the Linux kernel or packages used by app/mon servers THREAT41 | mitigated | High | Low | 6 medium | 3 low | Application Server (host), Monitoring Server (host) | Any |
| Tails ISO malicious THREAT42 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 3 low | Admin Workstation (device), Journalist Workstation (device), Secure Viewing Station | Nation State / Law Enforcement |
| Ubuntu ISO malicious THREAT43 | inform | High | Low | 6 medium | 3 low | Application Server (host), Monitoring Server (host) | Nation State / Law Enforcement |
| APT server man-in-the-middle and replaying old packages THREAT53 | partially mitigated | High | Low | 6 medium | 3 low | FPF apt repository | Nation State / Law Enforcement, Large Corporation |
| SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54 | mitigated | High | Low | 6 medium | 3 low | FPF apt repository | Nation State / Law Enforcement, Large Corporation, ISP |
| Journalist gets phished THREAT56 | inform | Medium | Medium | 6 medium | 3 low | Journalist Corporate Workstation | Any |
| Vulnerabilities maliciously introduced in APT packages THREAT159 | accepted | High | Low | 6 medium | 3 low | Ubuntu apt repository | Any |
| No mitigation or revocation for compromised key THREAT172 | partially mitigated | High | Low | 6 medium | 3 low | Application Server (host) | Nation State / Law Enforcement |
| Unknown vulnerability in a VM template THREATQW10 | mitigated | High | Low | 6 medium | 3 low | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement, Large Corporation, Developer error |
| Privilege escalation (Xen vulnerability) THREATQW11 | accepted | High | Low | 6 medium | 3 low | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement |
| Attacker obtains code execution in the sd-app VM THREATQW18 | mitigated | High | Low | 6 medium | 3 low | sd-app (SecureDrop Client) | Nation State / Law Enforcement, Large Corporation |
| Admin SSH Key is compromised THREAT3 Legacy (Tails/SVS) | accepted | High | Very Low | 3 low | 3 low | Admin Workstation (device) | Nation State / Law Enforcement, Large Corporation |
| Tor (now FPF) apt repo compromised THREAT44 | mitigated | High | Very Low | 3 low | 3 low | FPF apt repository | Nation State / Law Enforcement |
| Ubuntu APT Repo compromised THREAT45 | partially mitigated | High | Very Low | 3 low | 3 low | Ubuntu apt repository | Nation State / Law Enforcement |
| Tor browser exploit THREAT79 | accepted | High | Very Low | 3 low | 3 low | Source Tor Browser | Nation State / Law Enforcement |
| Monitor server is down THREAT158 | inform | Low | Medium | 3 low | 3 low | Monitoring Server (host) | Any |
| Side-channel attacks on Airgapped SVS THREAT160 Legacy (Tails/SVS) | accepted | High | Very Low | 3 low | 3 low | Secure Viewing Station | Nation State / Law Enforcement |
| CPU-based attacks THREATQW12 | accepted | High | Very Low | 3 low | 3 low | Workstation hardware | Nation State / Law Enforcement |
| Evil maid attack on bootloader THREATQW13 | accepted | High | Very Low | 3 low | 3 low | Workstation bootloader | Nation State / Law Enforcement, Large Corporation |
| Evil maid attack on firmware THREATQW14 | accepted | High | Very Low | 3 low | 3 low | Workstation firmware | Nation State / Law Enforcement |
| Side-channel analysis or exfiltration of sd-viewer VM THREATQW16 | partially mitigated | High | Very Low | 3 low | 3 low | sd-viewer (disposable VMs) | Nation State / Law Enforcement |
| Vulnerability in Qubes RPC implementation THREATQW44 | accepted | High | Very Low | 3 low | 3 low | Qubes OS and Xen | |
| qrexec vulnerability THREATQW51 | accepted | High | Very Low | 3 low | 3 low | Qubes OS and Xen | Any |
| open-in-dvm vulnerability THREATQW52 | accepted | High | Very Low | 3 low | 3 low | Qubes OS and Xen | Any |
| Zip bomb THREATQW53 | partially mitigated | Low | Medium | 3 low | 3 low | sd-app (SecureDrop Client) | |
| Attacker obtains code execution in the Network VM THREATQW17 | partially mitigated | Low | Low | 2 low | 3 low | sys-net | Nation State / Law Enforcement, Large Corporation |
| split-gpg vulnerability in upstream Qubes THREATQW50 | accepted | Medium | Very Low | 2 low | 3 low | Qubes OS and Xen | |
| Attacker obtains code execution in sd-viewer VM THREATQW1 | partially mitigated | High | Medium | 9 high | 2 low | sd-viewer (disposable VMs) | |
| MIME hander in sd-app doesn't handle submission format THREATQW8 | mitigated | High | Medium | 9 high | 2 low | sd-viewer (disposable VMs) | Developer error |
| Injection vulnerability in securedrop-client THREATQW9 | mitigated | High | Medium | 9 high | 2 low | sd-app (SecureDrop Client) | Nation State / Law Enforcement, Large Corporation |
| Macro executed in malicious office file THREATQW46 | mitigated | High | Medium | 9 high | 2 low | sd-viewer (disposable VMs) | |
| Admin's network being monitored THREAT4 Legacy (Tails/SVS) | mitigated | High | Low | 6 medium | 2 low | Admin Workstation (device) | Nation State / Law Enforcement |
| Transfer device passphrase compromised THREAT162 Legacy (Tails/SVS) | inform | High | Low | 6 medium | 2 low | Transfer Device | Any |
| Attacker obtains code execution in the GPG VM THREATQW6 | partially mitigated | High | Low | 6 medium | 2 low | sd-gpg | Nation State / Law Enforcement, Large Corporation |
| GPG VM (sd-gpg) performs attacker file decryption THREATQW7 | mitigated | High | Low | 6 medium | 2 low | sd-gpg | Nation State / Law Enforcement |
| Hyperthreading THREATQW54 | mitigated | High | Low | 6 medium | 2 low | Workstation hardware | Nation State / Law Enforcement |
| Web services vulnerability in Source interface THREAT30 | mitigated | Medium | Low | 4 medium | 2 low | Source Interface | Any |
| Vulnerabilities/Compromise of Hardware Firewall THREAT48 | mitigated | Medium | Low | 4 medium | 2 low | Dedicated Hardware Firewall | Nation State / Law Enforcement, Large Corporation |
| Hardware Firewall Misconfiguration THREAT49 | mitigated | Medium | Low | 4 medium | 2 low | Dedicated Hardware Firewall | Administrator error |
| Attacker exploits postfix THREAT67 | partially mitigated | Medium | Low | 4 medium | 2 low | Monitoring Server (host) | Nation State / Law Enforcement |
| Watering hole attack on client THREAT80 | mitigated | Medium | Low | 4 medium | 2 low | Source Tor Browser | Nation State / Law Enforcement |
| Web services vulnerability in Journalist interface THREAT82 | mitigated | Medium | Low | 4 medium | 2 low | Journalist Interface | Any |
| Attacker obtains code execution on sd-gpg VM THREATQW5 | partially mitigated | Medium | Low | 4 medium | 2 low | sd-gpg | |
| Journalist interface hidden service secret exfiltrated THREATQW39 | partially mitigated | Medium | Low | 4 medium | 2 low | sd-proxy | |
| Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use THREATQW67 | partially mitigated | Medium | Low | 4 medium | 2 low | sd-devices (export and print), sd-proxy | Any |
| Vulnerability introduced in code dependency of provisioning code THREATQW2 | avoided | High | Very Low | 3 low | 2 low | Workstation provisioning code | Nation State / Law Enforcement, Large Corporation, Developer error |
| Adversary exploits gzip parsing to get code execution THREATQW37 | accepted | High | Very Low | 3 low | 2 low | sd-app (SecureDrop Client) | |
| Large file DoS in client THREATQW57 | partially mitigated | Low | Medium | 3 low | 2 low | sd-app (SecureDrop Client) | |
| Landing page is unavailable THREAT62 | out of scope | Low | Low | 2 low | 2 low | Landing page | Nation State / Law Enforcement, Large Corporation, Troll |
| OSSEC and/or Journalist alert SMTP account credentials compromised THREAT69 | partially mitigated | Low | Low | 2 low | 2 low | Journalist Corporate Workstation, Postfix | Nation State / Law Enforcement, Large Corporation |
| OSSEC and/or Journalist alert private key compromised THREAT70 | partially mitigated | Low | Low | 2 low | 2 low | Journalist Corporate Workstation, Postfix | Nation State / Law Enforcement, Large Corporation, Hacker |
| SMTP relay compromised THREAT71 | partially mitigated | Low | Low | 2 low | 2 low | SMTP relay | |
| Journalist network being monitored THREAT161 Legacy (Tails/SVS) | partially mitigated | Low | Low | 2 low | 2 low | Journalist Workstation (device) | Nation State / Law Enforcement |
| Journalist user marks all submissions as seen THREAT171 | out of scope | Low | Low | 2 low | 2 low | Journalist Interface | Malicious journalist |
| DoS (Xen vulnerability) THREATQW3 | accepted | Low | Low | 2 low | 2 low | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Nation State / Law Enforcement |
| Attacker obtains code execution in the Firewall VM THREATQW4 | partially mitigated | Low | Low | 2 low | 2 low | sys-firewall | Nation State / Law Enforcement, Large Corporation |
| Failure in mime handling in sd-viewer THREATQW45 | partially mitigated | Low | Low | 2 low | 2 low | sd-viewer (disposable VMs) | |
| Compromised VM spoofs log origin THREATQW56 | accepted | Low | Low | 2 low | 2 low | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | Any |
| Landing page is framed THREAT63 | inform | Low | Low | 2 low | 1 low | Landing page | Any |
| Transfer device tampered THREAT46 Legacy (Tails/SVS) | inform | Low | Very Low | 1 low | 1 low | Transfer Device | Any |
| Attacks on the journalist corporate workstation (malware/seized/tampered) THREAT55 | out of scope | Unknown | Unknown | Unknown | Unknown | Journalist Corporate Workstation | Nation State / Law Enforcement, Large Corporation |
| News organization, journalist or admin targeted by legal action THREAT64 | out of scope | Unknown | Unknown | Unknown | Unknown | News Organization / Legal | |
| Physical access to server room THREAT84 | out of scope | Unknown | Unknown | Unknown | Unknown | SecureDrop server room | Nation State / Law Enforcement |
| Attacks on the journalist corporate network (monitored/tampered) THREAT164 | unmanaged | Unknown | Unknown | Unknown | Unknown | Journalist Corporate Workstation | Nation State / Law Enforcement, Large Corporation |
| Impersonation/clone of SecureDrop Instance to phish sources/journalists THREAT173 | unmanaged | Unknown | Unknown | Unknown | Unknown | Source Interface | |
| Qubes is backdoored THREATQW43 | accepted | Unknown | Unknown | Unknown | Unknown | Qubes OS and Xen | Nation State / Law Enforcement |
| Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 | accepted | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client), sd-devices (export and print), sd-gpg, sd-log, sd-proxy, sd-viewer (disposable VMs), sys-firewall, sys-net, sys-usb | |
| Code injection via messages into App render process THREATQW62 | unmanaged | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client) | |
| Malicious message plaintext is stored in database THREATQW63 | unmanaged | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client) | |
| Code injection via malicious attachments in App THREATQW64 | unmanaged | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client) | |
| Malware via malicious attachments in App THREATQW65 | unmanaged | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client) | |
| Data loss because of risk mitigations like sanatization THREATQW66 | unmanaged | Unknown | Unknown | Unknown | Unknown | sd-app (SecureDrop Client) |