Penetration Test Report (IncludeSecurity): IncludeSec SecureDrop Workstation Asmt November 2018

Security Assessment of SecureDrop’s
Virtual Machine Based Journalist Interface
(on behalf of Open Technology Fund)
Page 1 of 16
FINAL REPORT
TABLE OF CONTENTS
EXECUTIVE SUMMARY .................................................................................................................... 3
Scope and Methodology ........................................................................................................................... 3
Assessment Objectives .............................................................................................................................. 3
Findings Overview ..................................................................................................................................... 3
Next Steps ................................................................................................................................................. 3
ASSESSMENT RESULTS .................................................................................................................... 4
Introduction .................................................................................................................................... 5
CRITICAL-RISK FINDINGS ................................................................................................................. 5
HIGH-RISK FINDINGS ....................................................................................................................... 5
MEDIUM-RISK FINDINGS ................................................................................................................. 5
LOW-RISK FINDINGS ........................................................................................................................ 5
L1: Discretionary Access Controls used to Protect Sensitive Resources ................................................... 5
L2: PGP Private Key Stored Within Workstation Source Code Repository ............................................... 7
L3: Exfiltration Possible from Virtual Machines ........................................................................................ 8
L4: SecureDrop Authentication Token Is Not Revoked When Signing Out ............................................. 10
L5: Authentication Credentials Not Cleared From Memory After Use ................................................... 11
INFORMATIONAL FINDINGS .......................................................................................................... 13
I1: Qubes OS Dom0 Uses End Of Life Fedora Distribution ...................................................................... 13
I2: Sensitive Qubes OS Operations Do Not Require an Administrative Password .................................. 14
Page 2 of 16
FINAL REPORT
EXECUTIVE SUMMARY
Scope and Methodology
IncludeSec performed a security assessment, on behalf of the Open Technology Fund, of
SecureDrop’s Virtual Machine Based Journalist Interface. The assessment team performed a
eight day effort spanning from November 20th – November 30th 2018, using a Standard
Greybox Assessment Methodology which included a detailed review of all the components
described above in a manner consistent with the original Statement of Work (SOW).
Assessment Objectives
The objective of this assessment was to identify and confirm potential security vulnerabilities
within targets in-scope of the SOW. The team assigned a qualitative risk ranking to each finding.
IncludeSec also provided remediation steps which SecureDrop could implement to secure its
applications and systems.
Findings Overview
IncludeSec identified 7 categories of findings. There were 0 deemed a “Critical-Risk,” 0 deemed
a “High-Risk,” 0 deemed a “Medium-Risk,” and 5 deemed a “Low-Risk,” which pose some
tangible security risk. Additionally, 2 “Informational” level findings were identified that do not
immediately pose a security risk.
IncludeSec encourages SecureDrop to redefine the stated risk categorizations internally in a
manner that incorporates internal knowledge regarding threat model, deployment scenario,
user risk, and mitigation environmental factors.
Next Steps
IncludeSec advises SecureDrop to remediate as many findings as possible in a prioritized
manner and make systemic changes to the Software Development Life Cycle (SDLC) to prevent
further vulnerabilities from being introduced into future release cycles. This report can be used
by SecureDrop as a basis for any SDLC changes. IncludeSec welcomes the opportunity to assist
SecureDrop in improving their SDLC in future engagements by providing security assessments
of additional products.
Personal note: This assessment is dedicated to the memories of Aaron Schwartz and James
Dolan. Some of the IncludeSec team working on this project personally knew them and
appreciated their friendship. We also appreciate the hard work that Freedom of the Press
foundation is doing keeping their memories alive through continued excellence.
Page 3 of 16
FINAL REPORT
ASSESSMENT RESULTS
At the conclusion of the assessment, Include Security categorized findings into four levels of
perceived security risk: critical, high, medium, or low. Any informational findings for which the
assessment team perceived no direct security risk, were also reported in the spirit of full
disclosure. The risk categorizations below are guidelines that IncludeSec believes reflect best
practices in the security industry and may differ from internal perceived risk. It is common and
encouraged that all clients recategorize findings based on their internal business risk
tolerances. All findings are described in detail within the final report provided to SecureDrop.
Critical-Risk findings are those that pose an immediate and serious threat to the company’s
infrastructure and customers. This includes loss of system, access, or application control,
compromise of administrative accounts or restriction of system functions, or the exposure of
confidential information. These threats should take priority during remediation efforts.
High-Risk findings are those that could pose serious threats including loss of system, access, or
application control, compromise of administrative accounts or restriction of system functions,
or the exposure of confidential information.
Medium-Risk findings are those that could potentially be used with other techniques to
compromise accounts, data, or performance.
Low-Risk findings pose limited exposure to compromise or loss of data, and are typically
attributed to configuration issues, and outdated patches or policies.
Informational findings pose little to no security exposure to compromise or loss of data which
cover defense-in-depth and best-practice changes which we recommend are made to the
application.
The findings below are listed by a risk rated short name (e.g., C1, H2, M3, L4, I5) and finding
title. Each finding includes: Description (including proof of concept screenshots and lines of
code), Recommended Remediation, and References.
Page 4 of 16
FINAL REPORT
INTRODUCTION
The assessment team performed an audit of the new SecureDrop Qubes OS based workstation.
Which is an open source product to allow journalist to receive anonymous files and
communications via Tor. The assessment performed was time-boxed to five days which
encompassed the total time for kick-off meetings, setup and configuration, as well as report
authoring.
The scope of the assessment was limited to a security review of the configuration and use of
the Qubes OS as a workstation for journalists using the SecureDrop platform. An examination of
Qubes OS or the entire SecureDrop platform was out of the scope of this assessment.
IncludeSec welcomes the challenge either of those assessments as a future next step of security
review.
CRITICAL-RISK FINDINGS
None identified in the project time window within the defined scope.
HIGH-RISK FINDINGS
None identified in the project time window within the defined scope.
MEDIUM-RISK FINDINGS
None identified in the