Threats × Components
A filled cell means the threat applies to that component. Its color shows the threat's status:
unmanagedpartially mitigatedacceptedtransferredinformavoidedmitigatedout of scope
| Component | THREAT3 · Admin SSH Key is compromised | THREAT4 · Admin's network being monitored | THREAT5 · Configuration vulnerability in Source interface | THREAT6 · Segmentation between Journalist and Source interfaces | THREAT7 · Session management vulnerability in Journalist interface | THREAT8 · Malicious input vulnerability in Journalist interface | THREAT13 · Authentication vulnerability in Journalist interface | THREAT24 · Business logic vulnerability in Source interface | THREAT25 · File and resource vulnerability in Source interface | THREAT28 · Malicious code introduced in SecureDrop repository | THREAT29 · Malicious code introduced in SecureDrop release | THREAT31 · Firewall rule misconfiguration on application server | THREAT32 · Submission interface is framed | THREAT33 · Journalist interface is framed | THREAT34 · Known exploitable vulnerabilities in Python or libraries used by SecureDrop | THREAT35 · Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) | THREAT36 · Malicious apt package installed at install-time or during updates | THREAT37 · Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) | THREAT38 · Unknown vulnerabilities in Python or libraries used by SecureDrop | THREAT39 · Known weakness in hidden service cryptography | THREAT40 · Unknown vulnerabilities in the Linux Kernel | THREAT41 · Known vulnerabilities in the Linux kernel or packages used by app/mon servers | THREAT42 · Tails ISO malicious | THREAT43 · Ubuntu ISO malicious | THREAT44 · Tor (now FPF) apt repo compromised | THREAT45 · Ubuntu APT Repo compromised | THREAT50 · Github is compomised | THREAT51 · Compromise package build servers | THREAT52 · SecureDrop.org compromised | THREAT53 · APT server man-in-the-middle and replaying old packages | THREAT54 · SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. | THREAT57 · Landing page source control is compromised | THREAT58 · Landing page host is compromised | THREAT65 · Monitor server configuration error | THREAT72 · Airgapped SVS malware | THREAT73 · DNS requests to news organization's subdomain for SecureDrop landing page, freedom.press, torproject.org Tor activity, SD submissions may be correlated | THREAT74 · Source codename compromised | THREAT75 · Source uses tor2web | THREAT76 · Source reveals that they are using securedrop/leaking documents | THREAT79 · Tor browser exploit | THREAT85 · DNS | THREAT86 · Vulnerabilities maliciously introduced in python libraries | THREAT87 · Failure to sanitize documents | THREAT88 · Source submits identifying information | THREAT89 · Source goes to wrong source interface onion URL | THREAT90 · DNS request to .onion address | THREAT94 · Admin laptop seized No mitigations listed for this threat. | THREAT95 · Admin laptop tampered | THREAT96 · Admin laptop supply chain attack No mitigations listed for this threat. | THREAT97 · Admin Tails USB stick tampered No mitigations listed for this threat. | THREAT99 · App server supply chain attack No mitigations listed for this threat. | THREAT100 · Admin laptop seized while powered on | THREAT101 · Admin Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | THREAT102 · Admin Tails workstation firmware compromised No mitigations listed for this threat. | THREAT103 · Admin activity compromised physical surveillance (e.g.: video camera) | THREAT106 · Admin key sent by (smail) mail and intercepted | THREAT107 · App server (physical) tampering | THREAT109 · App server processes submission in plaintext | THREAT110 · Firmware exploits/ME exploits for application server No mitigations listed for this threat. | THREAT112 · Journalist Tails workstation seized | THREAT113 · Journalist Tails workstation seized while powered on | THREAT114 · Journalist Tails workstation tampered No mitigations listed for this threat. | THREAT115 · Journalist Tails workstation supply chain attack No mitigations listed for this threat. | THREAT116 · Journalist workstation Tails key tampered No mitigations listed for this threat. | THREAT117 · Journalist Tails workstation firmware compromised | THREAT118 · Journalist Tails workstation compromised by malware | THREAT119 · Journalist activity compromised physical surveillance (e.g.: video camera) | THREAT120 · Failure to segregate Securedrop environment from corporate environment or personal environment | THREAT122 · Landing page TLS private key compromised | THREAT123 · QUANTUM-like attacks for Landing page No mitigations listed for this threat. | THREAT124 · Monitor server is tampered | THREAT125 · Monitor server supply chain attack No mitigations listed for this threat. | THREAT126 · Submission key is moved to a non-airgapped machine - journalist/admin workstation | THREAT127 · Airgapped SVS laptop seized while powered on No mitigations listed for this threat. | THREAT128 · Exfiltration of SVS data through malicious documents | THREAT129 · USB transfer device malware compromises SVS | THREAT130 · Airgapped SVS laptop seized No mitigations listed for this threat. | THREAT132 · Airgapped SVS supply chain attack No mitigations listed for this threat. | THREAT133 · Airgapped SVS Tails key seized | THREAT134 · Airgapped SVS Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | THREAT135 · Source is already compromised by malware No mitigations listed for this threat. | THREAT137 · Website fingerprinting of source interface No mitigations listed for this threat. | THREAT159 · Vulnerabilities maliciously introduced in APT packages | THREAT160 · Side-channel attacks on Airgapped SVS No mitigations listed for this threat. | THREAT162 · Transfer device passphrase compromised | THREAT163 · Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail No mitigations listed for this threat. | THREAT166 · Source submits large / invalid messages | THREAT167 · OSSEC rules configuration error on application server | THREAT168 · SSH configuration error on application server | THREAT169 · Application server configuration error | THREAT172 · No mitigation or revocation for compromised key | THREATQW1 · Attacker obtains code execution in sd-viewer VM | THREATQW2 · Vulnerability introduced in code dependency of provisioning code No mitigations listed for this threat. | THREATQW6 · Attacker obtains code execution in the GPG VM No mitigations listed for this threat. | THREATQW7 · GPG VM (sd-gpg) performs attacker file decryption No mitigations listed for this threat. | THREATQW8 · MIME hander in sd-app doesn't handle submission format No mitigations listed for this threat. | THREATQW9 · Injection vulnerability in securedrop-client | THREATQW10 · Unknown vulnerability in a VM template | THREATQW11 · Privilege escalation (Xen vulnerability) | THREATQW12 · CPU-based attacks | THREATQW13 · Evil maid attack on bootloader No mitigations listed for this threat. | THREATQW14 · Evil maid attack on firmware No mitigations listed for this threat. | THREATQW15 · Vulnerability introduced in provisioning code No mitigations listed for this threat. | THREATQW16 · Side-channel analysis or exfiltration of sd-viewer VM | THREATQW18 · Attacker obtains code execution in the sd-app VM | THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | THREATQW22 · Known vulnerability in any VM template | THREATQW23 · Attacker obtains code execution in proxy VM | THREATQW25 · Intel Firmware (incl. management engine vulnerability) No mitigations listed for this threat. | THREATQW26 · Supply chain attack on workstation hardware No mitigations listed for this threat. | THREATQW28 · Malicious VM template No mitigations listed for this threat. | THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | THREATQW32 · Evil maid attack on the operating system | THREATQW34 · Compromise wheel/package build machines No mitigations listed for this threat. | THREATQW35 · Supply chain attack on Python dependencies, e.g. developer of Python dependency uploads malicious source or binary release (either intentionally or accidentally), PSF PyPI is compromised No mitigations listed for this threat. | THREATQW36 · Attacker obtains code execution in any VM | THREATQW37 · Adversary exploits gzip parsing to get code execution | THREATQW40 · Plaintext submissions exfiltrated | THREATQW44 · Vulnerability in Qubes RPC implementation No mitigations listed for this threat. | THREATQW46 · Macro executed in malicious office file | THREATQW47 · DMA executed from compromised network VM (in a system that lacks VT-d) No mitigations listed for this threat. | THREATQW51 · qrexec vulnerability No mitigations listed for this threat. | THREATQW52 · open-in-dvm vulnerability No mitigations listed for this threat. | THREATQW54 · Hyperthreading | THREATQW55 · Qubes RPC policy misconfiguration | THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | THREATQW59 · Attacker has temporary physical access to workstation laptop | THREATQW60 · Attacker has temporary physical access to workstation laptop and can disassemble it | THREATQW61 · Malicious or coerced administrator No mitigations listed for this threat. | THREAT1 · Admin two-factor authentication device is lost or compromised | THREAT2 · Admin workstation backup stick is compromised | THREAT9 · Configuration vulnerability in Journalist interface | THREAT10 · Authentication vulnerability in Source interface | THREAT11 · Access control vulnerability in Source interface | THREAT12 · Data protection vulnerability in Source interface | THREAT14 · Access control vulnerability in Journalist interface | THREAT15 · Data protection vulnerability in Journalist interface | THREAT16 · Communications vulnerability in Source interface | THREAT17 · Communications vulnerability in Journalist interface | THREAT18 · File and resource vulnerability in Journalist interface | THREAT19 · Session management vulnerability in Source interface | THREAT20 · Malicious input vulnerability in Source interface | THREAT21 · Failure to encrypt submissions as they are written to disk | THREAT22 · Error handling and logging vulnerability in Source interface | THREAT23 · HTTP security configuration vulnerability in Source interface | THREAT26 · Error handling and logging vulnerability in Journalist interface | THREAT27 · HTTP security configuration vulnerability in Journalist interface | THREAT30 · Web services vulnerability in Source interface | THREAT47 · Firewall not up to date | THREAT48 · Vulnerabilities/Compromise of Hardware Firewall | THREAT49 · Hardware Firewall Misconfiguration | THREAT56 · Journalist gets phished | THREAT59 · Landing page DNS leaks from Securedrop/leaks-related subdomain | THREAT60 · User web traffic to SecureDrop landing page is logged | THREAT61 · User web traffic to SecureDrop landing page is uses CDN and may be logged | THREAT66 · Monitor server is compromised | THREAT67 · Attacker exploits postfix | THREAT68 · News Organization network is compromised | THREAT77 · Tor network exploit No mitigations listed for this threat. | THREAT78 · Source uses employer/corporate device | THREAT80 · Watering hole attack on client | THREAT81 · Transfer device seized/stolen/lost | THREAT82 · Web services vulnerability in Journalist interface | THREAT91 · Source visits torproject.org No mitigations listed for this threat. | THREAT92 · Source visits securedrop.org, freedom.press | THREAT93 · SecureDrop server identification No mitigations listed for this threat. | THREAT98 · Admin violates compartmentalisation procedure No mitigations listed for this threat. | THREAT104 · Admin modifies Source interface Application code No mitigations listed for this threat. | THREAT105 · NTP No mitigations listed for this threat. | THREAT108 · Application server full of submissions | THREAT121 · Journalist workstation Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | THREAT131 · Source activity is compromised via physical surveillance (e.g.: camera) | THREAT136 · Source network being monitored | THREAT138 · Unsanitized decrypted files are transfered to journalist workstation without prior sanitization | THREAT139 · Malware on transfer device breaks SVS airgap No mitigations listed for this threat. | THREAT140 · Additional software installed on Admin Workstation No mitigations listed for this threat. | THREAT141 · Backups No mitigations listed for this threat. | THREAT142 · SVS drive plugged into/mounted on non-airgapped machine. No mitigations listed for this threat. | THREAT143 · USB transfer device malware compromises Journalist Workstation No mitigations listed for this threat. | THREAT144 · Admin Tails USB stick lost/seized | THREAT145 · Compromise admin's corporate (or personal) devices or accounts | THREAT146 · Business Logic vulnerability in Journalist interface | THREAT147 · App server seized | THREAT148 · Application-server DDoS No mitigations listed for this threat. | THREAT149 · Firewall logs are not monitored No mitigations listed for this threat. | THREAT150 · Hardware Firewall Supply chain attack | THREAT151 · Journalist workstation Tails Key seized | THREAT152 · Monitor server is seized | THREAT153 · Airgapped SVS Tails key tampered | THREAT154 · SVS activity compromised physical surveillance (e.g.: video camera) | THREAT155 · Source resides in geographical location with very low Tor usage No mitigations listed for this threat. | THREAT156 · Source searches for SecureDrop on search engines | THREAT157 · Journalist two-factor authentication device is lost or compromised No mitigations listed for this threat. | THREAT165 · Airgap broken by documents being decrypted on transfer device No mitigations listed for this threat. | THREAT170 · Journalist user performs malicious action under another user's account | THREATQW5 · Attacker obtains code execution on sd-gpg VM No mitigations listed for this threat. | THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | THREATQW27 · Vulnerability in the QubesOS management layer No mitigations listed for this threat. | THREATQW30 · Workstation laptop is seized/stolen No mitigations listed for this threat. | THREATQW38 · Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token | THREATQW39 · Journalist interface hidden service secret exfiltrated No mitigations listed for this threat. | THREATQW42 · Attacker tampers with replies in sd-proxy No mitigations listed for this threat. | THREATQW50 · split-gpg vulnerability in upstream Qubes No mitigations listed for this threat. | THREATQW67 · Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use No mitigations listed for this threat. | THREAT46 · Transfer device tampered | THREAT62 · Landing page is unavailable No mitigations listed for this threat. | THREAT63 · Landing page is framed | THREAT69 · OSSEC and/or Journalist alert SMTP account credentials compromised | THREAT70 · OSSEC and/or Journalist alert private key compromised | THREAT71 · SMTP relay compromised | THREAT158 · Monitor server is down No mitigations listed for this threat. | THREAT161 · Journalist network being monitored | THREAT171 · Journalist user marks all submissions as seen No mitigations listed for this threat. | THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | THREATQW4 · Attacker obtains code execution in the Firewall VM No mitigations listed for this threat. | THREATQW17 · Attacker obtains code execution in the Network VM No mitigations listed for this threat. | THREATQW45 · Failure in mime handling in sd-viewer | THREATQW53 · Zip bomb No mitigations listed for this threat. | THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | THREATQW57 · Large file DoS in client | THREAT55 · Attacks on the journalist corporate workstation (malware/seized/tampered) No mitigations listed for this threat. | THREAT64 · News organization, journalist or admin targeted by legal action | THREAT84 · Physical access to server room No mitigations listed for this threat. | THREAT164 · Attacks on the journalist corporate network (monitored/tampered) No mitigations listed for this threat. | THREAT173 · Impersonation/clone of SecureDrop Instance to phish sources/journalists No mitigations listed for this threat. | THREATQW43 · Qubes is backdoored No mitigations listed for this threat. | THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | THREATQW62 · Code injection via messages into App render process No mitigations listed for this threat. | THREATQW63 · Malicious message plaintext is stored in database No mitigations listed for this threat. | THREATQW64 · Code injection via malicious attachments in App No mitigations listed for this threat. | THREATQW65 · Malware via malicious attachments in App No mitigations listed for this threat. | THREATQW66 · Data loss because of risk mitigations like sanatization No mitigations listed for this threat. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Component | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Admin Workstation (device) Legacy (Tails/SVS) | ● THREAT3 · Admin SSH Key is compromised | ● THREAT4 · Admin's network being monitored | ● THREAT42 · Tails ISO malicious | ● THREAT94 · Admin laptop seized No mitigations listed for this threat. | ● THREAT95 · Admin laptop tampered | ● THREAT96 · Admin laptop supply chain attack No mitigations listed for this threat. | ● THREAT97 · Admin Tails USB stick tampered No mitigations listed for this threat. | ● THREAT100 · Admin laptop seized while powered on | ● THREAT101 · Admin Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | ● THREAT102 · Admin Tails workstation firmware compromised No mitigations listed for this threat. | ● THREAT103 · Admin activity compromised physical surveillance (e.g.: video camera) | ● THREAT106 · Admin key sent by (smail) mail and intercepted | ● THREAT120 · Failure to segregate Securedrop environment from corporate environment or personal environment | ● THREAT1 · Admin two-factor authentication device is lost or compromised | ● THREAT98 · Admin violates compartmentalisation procedure No mitigations listed for this threat. | ● THREAT140 · Additional software installed on Admin Workstation No mitigations listed for this threat. | ● THREAT144 · Admin Tails USB stick lost/seized | ● THREAT145 · Compromise admin's corporate (or personal) devices or accounts | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| App Server SSH | ● THREAT168 · SSH configuration error on application server | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Application Server (host) | ● THREAT31 · Firewall rule misconfiguration on application server | ● THREAT40 · Unknown vulnerabilities in the Linux Kernel | ● THREAT41 · Known vulnerabilities in the Linux kernel or packages used by app/mon servers | ● THREAT43 · Ubuntu ISO malicious | ● THREAT99 · App server supply chain attack No mitigations listed for this threat. | ● THREAT107 · App server (physical) tampering | ● THREAT110 · Firmware exploits/ME exploits for application server No mitigations listed for this threat. | ● THREAT172 · No mitigation or revocation for compromised key | ● THREAT93 · SecureDrop server identification No mitigations listed for this threat. | ● THREAT147 · App server seized | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Backup / recovery media | ● THREAT2 · Admin workstation backup stick is compromised | ● THREAT141 · Backups No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| DNS resolver | ● THREAT85 · DNS | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Dedicated Hardware Firewall | ● THREAT47 · Firewall not up to date | ● THREAT48 · Vulnerabilities/Compromise of Hardware Firewall | ● THREAT49 · Hardware Firewall Misconfiguration | ● THREAT149 · Firewall logs are not monitored No mitigations listed for this threat. | ● THREAT150 · Hardware Firewall Supply chain attack | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Encrypted submission store | ● THREAT108 · Application server full of submissions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| FPF apt repository | ● THREAT44 · Tor (now FPF) apt repo compromised | ● THREAT53 · APT server man-in-the-middle and replaying old packages | ● THREAT54 · SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Journalist Corporate Workstation | ● THREAT56 · Journalist gets phished | ● THREAT69 · OSSEC and/or Journalist alert SMTP account credentials compromised | ● THREAT70 · OSSEC and/or Journalist alert private key compromised | ● THREAT55 · Attacks on the journalist corporate workstation (malware/seized/tampered) No mitigations listed for this threat. | ● THREAT164 · Attacks on the journalist corporate network (monitored/tampered) No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Journalist Interface | ● THREAT6 · Segmentation between Journalist and Source interfaces | ● THREAT7 · Session management vulnerability in Journalist interface | ● THREAT8 · Malicious input vulnerability in Journalist interface | ● THREAT13 · Authentication vulnerability in Journalist interface | ● THREAT33 · Journalist interface is framed | ● THREAT14 · Access control vulnerability in Journalist interface | ● THREAT15 · Data protection vulnerability in Journalist interface | ● THREAT17 · Communications vulnerability in Journalist interface | ● THREAT18 · File and resource vulnerability in Journalist interface | ● THREAT26 · Error handling and logging vulnerability in Journalist interface | ● THREAT82 · Web services vulnerability in Journalist interface | ● THREAT146 · Business Logic vulnerability in Journalist interface | ● THREAT170 · Journalist user performs malicious action under another user's account | ● THREAT171 · Journalist user marks all submissions as seen No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Journalist Workstation (device) Legacy (Tails/SVS) | ● THREAT42 · Tails ISO malicious | ● THREAT87 · Failure to sanitize documents | ● THREAT112 · Journalist Tails workstation seized | ● THREAT113 · Journalist Tails workstation seized while powered on | ● THREAT114 · Journalist Tails workstation tampered No mitigations listed for this threat. | ● THREAT115 · Journalist Tails workstation supply chain attack No mitigations listed for this threat. | ● THREAT116 · Journalist workstation Tails key tampered No mitigations listed for this threat. | ● THREAT117 · Journalist Tails workstation firmware compromised | ● THREAT118 · Journalist Tails workstation compromised by malware | ● THREAT119 · Journalist activity compromised physical surveillance (e.g.: video camera) | ● THREAT120 · Failure to segregate Securedrop environment from corporate environment or personal environment | ● THREAT121 · Journalist workstation Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | ● THREAT143 · USB transfer device malware compromises Journalist Workstation No mitigations listed for this threat. | ● THREAT151 · Journalist workstation Tails Key seized | ● THREAT157 · Journalist two-factor authentication device is lost or compromised No mitigations listed for this threat. | ● THREAT161 · Journalist network being monitored | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Landing page | ● THREAT57 · Landing page source control is compromised | ● THREAT58 · Landing page host is compromised | ● THREAT122 · Landing page TLS private key compromised | ● THREAT123 · QUANTUM-like attacks for Landing page No mitigations listed for this threat. | ● THREAT59 · Landing page DNS leaks from Securedrop/leaks-related subdomain | ● THREAT60 · User web traffic to SecureDrop landing page is logged | ● THREAT61 · User web traffic to SecureDrop landing page is uses CDN and may be logged | ● THREAT62 · Landing page is unavailable No mitigations listed for this threat. | ● THREAT63 · Landing page is framed | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Monitoring Server (host) | ● THREAT40 · Unknown vulnerabilities in the Linux Kernel | ● THREAT41 · Known vulnerabilities in the Linux kernel or packages used by app/mon servers | ● THREAT43 · Ubuntu ISO malicious | ● THREAT65 · Monitor server configuration error | ● THREAT124 · Monitor server is tampered | ● THREAT125 · Monitor server supply chain attack No mitigations listed for this threat. | ● THREAT66 · Monitor server is compromised | ● THREAT67 · Attacker exploits postfix | ● THREAT93 · SecureDrop server identification No mitigations listed for this threat. | ● THREAT152 · Monitor server is seized | ● THREAT158 · Monitor server is down No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| NTP server | ● THREAT105 · NTP No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| News Organization / Legal | ● THREAT68 · News Organization network is compromised | ● THREAT64 · News organization, journalist or admin targeted by legal action | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| OSSEC client | ● THREAT167 · OSSEC rules configuration error on application server | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Postfix | ● THREAT69 · OSSEC and/or Journalist alert SMTP account credentials compromised | ● THREAT70 · OSSEC and/or Journalist alert private key compromised | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Qubes OS and Xen | ● THREATQW32 · Evil maid attack on the operating system | ● THREATQW44 · Vulnerability in Qubes RPC implementation No mitigations listed for this threat. | ● THREATQW51 · qrexec vulnerability No mitigations listed for this threat. | ● THREATQW52 · open-in-dvm vulnerability No mitigations listed for this threat. | ● THREATQW27 · Vulnerability in the QubesOS management layer No mitigations listed for this threat. | ● THREATQW50 · split-gpg vulnerability in upstream Qubes No mitigations listed for this threat. | ● THREATQW43 · Qubes is backdoored No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SMTP relay | ● THREAT71 · SMTP relay compromised | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Secure Viewing Station Legacy (Tails/SVS) | ● THREAT42 · Tails ISO malicious | ● THREAT72 · Airgapped SVS malware | ● THREAT126 · Submission key is moved to a non-airgapped machine - journalist/admin workstation | ● THREAT127 · Airgapped SVS laptop seized while powered on No mitigations listed for this threat. | ● THREAT128 · Exfiltration of SVS data through malicious documents | ● THREAT130 · Airgapped SVS laptop seized No mitigations listed for this threat. | ● THREAT132 · Airgapped SVS supply chain attack No mitigations listed for this threat. | ● THREAT133 · Airgapped SVS Tails key seized | ● THREAT134 · Airgapped SVS Tails Persistent Volume passphrase compromised No mitigations listed for this threat. | ● THREAT160 · Side-channel attacks on Airgapped SVS No mitigations listed for this threat. | ● THREAT142 · SVS drive plugged into/mounted on non-airgapped machine. No mitigations listed for this threat. | ● THREAT153 · Airgapped SVS Tails key tampered | ● THREAT154 · SVS activity compromised physical surveillance (e.g.: video camera) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SecureDrop Application | ● THREAT5 · Configuration vulnerability in Source interface | ● THREAT169 · Application server configuration error | ● THREAT9 · Configuration vulnerability in Journalist interface | ● THREAT23 · HTTP security configuration vulnerability in Source interface | ● THREAT27 · HTTP security configuration vulnerability in Journalist interface | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SecureDrop release & package build | ● THREAT29 · Malicious code introduced in SecureDrop release | ● THREAT51 · Compromise package build servers | ● THREATQW34 · Compromise wheel/package build machines No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SecureDrop server room | ● THREAT84 · Physical access to server room No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SecureDrop source repository | ● THREAT28 · Malicious code introduced in SecureDrop repository | ● THREAT34 · Known exploitable vulnerabilities in Python or libraries used by SecureDrop | ● THREAT50 · Github is compomised | ● THREAT86 · Vulnerabilities maliciously introduced in python libraries | ● THREATQW35 · Supply chain attack on Python dependencies, e.g. developer of Python dependency uploads malicious source or binary release (either intentionally or accidentally), PSF PyPI is compromised No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SecureDrop.org directory | ● THREAT52 · SecureDrop.org compromised | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source Interface | ● THREAT24 · Business logic vulnerability in Source interface | ● THREAT25 · File and resource vulnerability in Source interface | ● THREAT32 · Submission interface is framed | ● THREAT38 · Unknown vulnerabilities in Python or libraries used by SecureDrop | ● THREAT109 · App server processes submission in plaintext | ● THREAT137 · Website fingerprinting of source interface No mitigations listed for this threat. | ● THREAT166 · Source submits large / invalid messages | ● THREAT10 · Authentication vulnerability in Source interface | ● THREAT11 · Access control vulnerability in Source interface | ● THREAT12 · Data protection vulnerability in Source interface | ● THREAT16 · Communications vulnerability in Source interface | ● THREAT19 · Session management vulnerability in Source interface | ● THREAT20 · Malicious input vulnerability in Source interface | ● THREAT21 · Failure to encrypt submissions as they are written to disk | ● THREAT22 · Error handling and logging vulnerability in Source interface | ● THREAT30 · Web services vulnerability in Source interface | ● THREAT104 · Admin modifies Source interface Application code No mitigations listed for this threat. | ● THREAT148 · Application-server DDoS No mitigations listed for this threat. | ● THREAT173 · Impersonation/clone of SecureDrop Instance to phish sources/journalists No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source Tor Browser | ● THREAT75 · Source uses tor2web | ● THREAT79 · Tor browser exploit | ● THREAT88 · Source submits identifying information | ● THREAT89 · Source goes to wrong source interface onion URL | ● THREAT77 · Tor network exploit No mitigations listed for this threat. | ● THREAT80 · Watering hole attack on client | ● THREAT91 · Source visits torproject.org No mitigations listed for this threat. | ● THREAT92 · Source visits securedrop.org, freedom.press | ● THREAT155 · Source resides in geographical location with very low Tor usage No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source environment | ● THREAT73 · DNS requests to news organization's subdomain for SecureDrop landing page, freedom.press, torproject.org Tor activity, SD submissions may be correlated | ● THREAT74 · Source codename compromised | ● THREAT76 · Source reveals that they are using securedrop/leaking documents | ● THREAT90 · DNS request to .onion address | ● THREAT135 · Source is already compromised by malware No mitigations listed for this threat. | ● THREAT163 · Source googles for SecureDrop, clicks on link on Twitter, or other metadata trail No mitigations listed for this threat. | ● THREAT78 · Source uses employer/corporate device | ● THREAT131 · Source activity is compromised via physical surveillance (e.g.: camera) | ● THREAT136 · Source network being monitored | ● THREAT156 · Source searches for SecureDrop on search engines | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Tor software | ● THREAT35 · Known vulnerabilities in Tor (incl. Onion Service cryptography, authentication) | ● THREAT37 · Unknown vulnerabilities in Tor (incl. Onion Service cryptography, authentication) | ● THREAT39 · Known weakness in hidden service cryptography | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Transfer Device Legacy (Tails/SVS) | ● THREAT129 · USB transfer device malware compromises SVS | ● THREAT162 · Transfer device passphrase compromised | ● THREAT81 · Transfer device seized/stolen/lost | ● THREAT138 · Unsanitized decrypted files are transfered to journalist workstation without prior sanitization | ● THREAT139 · Malware on transfer device breaks SVS airgap No mitigations listed for this threat. | ● THREAT165 · Airgap broken by documents being decrypted on transfer device No mitigations listed for this threat. | ● THREAT46 · Transfer device tampered | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ubuntu apt repository | ● THREAT36 · Malicious apt package installed at install-time or during updates | ● THREAT45 · Ubuntu APT Repo compromised | ● THREAT159 · Vulnerabilities maliciously introduced in APT packages | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Workstation bootloader | ● THREATQW13 · Evil maid attack on bootloader No mitigations listed for this threat. | ● THREATQW59 · Attacker has temporary physical access to workstation laptop | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Workstation firmware | ● THREATQW14 · Evil maid attack on firmware No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Workstation hardware | ● THREATQW12 · CPU-based attacks | ● THREATQW25 · Intel Firmware (incl. management engine vulnerability) No mitigations listed for this threat. | ● THREATQW26 · Supply chain attack on workstation hardware No mitigations listed for this threat. | ● THREATQW54 · Hyperthreading | ● THREATQW60 · Attacker has temporary physical access to workstation laptop and can disassemble it | ● THREATQW30 · Workstation laptop is seized/stolen No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Workstation provisioning code | ● THREATQW2 · Vulnerability introduced in code dependency of provisioning code No mitigations listed for this threat. | ● THREATQW15 · Vulnerability introduced in provisioning code No mitigations listed for this threat. | ● THREATQW61 · Malicious or coerced administrator No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| dom0 | ● THREATQW55 · Qubes RPC policy misconfiguration | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-app (SecureDrop Client) | ● THREATQW9 · Injection vulnerability in securedrop-client | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW18 · Attacker obtains code execution in the sd-app VM | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW37 · Adversary exploits gzip parsing to get code execution | ● THREATQW40 · Plaintext submissions exfiltrated | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW38 · Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW53 · Zip bomb No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW57 · Large file DoS in client | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | ● THREATQW62 · Code injection via messages into App render process No mitigations listed for this threat. | ● THREATQW63 · Malicious message plaintext is stored in database No mitigations listed for this threat. | ● THREATQW64 · Code injection via malicious attachments in App No mitigations listed for this threat. | ● THREATQW65 · Malware via malicious attachments in App No mitigations listed for this threat. | ● THREATQW66 · Data loss because of risk mitigations like sanatization No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-devices (export and print) | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW67 · Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-gpg | ● THREATQW6 · Attacker obtains code execution in the GPG VM No mitigations listed for this threat. | ● THREATQW7 · GPG VM (sd-gpg) performs attacker file decryption No mitigations listed for this threat. | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW5 · Attacker obtains code execution on sd-gpg VM No mitigations listed for this threat. | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-log | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-proxy | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW23 · Attacker obtains code execution in proxy VM | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW38 · Journalist Interface credentials exfiltrated (passphrase, single code, username), and API token | ● THREATQW39 · Journalist interface hidden service secret exfiltrated No mitigations listed for this threat. | ● THREATQW42 · Attacker tampers with replies in sd-proxy No mitigations listed for this threat. | ● THREATQW67 · Lingering files in VMs (sd-proxy, sd-devices) are not deleted after use No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sd-viewer (disposable VMs) | ● THREATQW1 · Attacker obtains code execution in sd-viewer VM | ● THREATQW8 · MIME hander in sd-app doesn't handle submission format No mitigations listed for this threat. | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW16 · Side-channel analysis or exfiltration of sd-viewer VM | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW46 · Macro executed in malicious office file | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW45 · Failure in mime handling in sd-viewer | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sys-firewall | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW4 · Attacker obtains code execution in the Firewall VM No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sys-net | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW47 · DMA executed from compromised network VM (in a system that lacks VT-d) No mitigations listed for this threat. | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW17 · Attacker obtains code execution in the Network VM No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| sys-usb | ● THREATQW10 · Unknown vulnerability in a VM template | ● THREATQW11 · Privilege escalation (Xen vulnerability) | ● THREATQW19 · User error while operating the workstation No mitigations listed for this threat. | ● THREATQW22 · Known vulnerability in any VM template | ● THREATQW28 · Malicious VM template No mitigations listed for this threat. | ● THREATQW29 · Side-channel analysis or exfiltration of GPG keys or other sensitive data | ● THREATQW31 · Admin error in provisioning of the workstation No mitigations listed for this threat. | ● THREATQW36 · Attacker obtains code execution in any VM | ● THREATQW58 · Vulnerability introduced to AppVMs via Template dependency | ● THREATQW21 · Information disclosure (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW3 · DoS (Xen vulnerability) No mitigations listed for this threat. | ● THREATQW56 · Compromised VM spoofs log origin No mitigations listed for this threat. | ● THREATQW48 · Inter-vm covert channels (e.g. CPU cache) used for exfiltration No mitigations listed for this threat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||