Penetration Test Report (iSEC): iSEC OTF FPF SecureDrop Deliverable v1.2

Freedom of the Press
SecureDrop
Configuration Review &
Application Penetration Test
Prepared for:
Prepared by:
Raphael Salas — iSEC Technical Lead
Valentin Leon — Senior Security Engineer
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page2of26
©2015,iSECPartners,Inc.
PreparedbyiSECPartners,Inc.forFreedomofthePress.Portionsofthisdocumentandthetemplatesusedinits
productionarethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page3of26
DocumentChangeLog
Version Date Change
1.0 2015-06-05 ReleasefortheFreedomofthePressFoundation.
1.1 2015-07-06 Publicrelease.
1.2 2015-12-08 UnredacttheOSSECbugafterconversationswiththeOSSECteam.
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page4of26
Table of Contents
1 ExecutiveSummary ........................................................ 5
1.1 iSECRiskSummary ........................................................... 6
1.2 ProjectSummary ............................................................. 7
1.3 FindingsSummary............................................................ 7
1.4 RecommendationsSummary................................................... 8
2 EngagementStructure ..................................................... 10
2.1 InternalandExternalTeams ................................................... 10
2.2 ProjectGoalsandScope ....................................................... 11
3 DetailedFindings .......................................................... 12
3.1 Classifications................................................................ 12
3.2 Vulnerabilities ............................................................... 14
3.3 DetailedVulnerabilityList ..................................................... 15
Appendices .................................................................... 25
A AdditionalHardeningRecommendations ................................ 25
A.1 Grsecurity ................................................................... 25
A.2 TailsConcerns ............................................................... 25
A.3 AirgapHardening ............................................................ 26
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page5of26
1 Executive Summary
ApplicationSummary
ApplicationName SecureDrop
ApplicationVersion 0.3.3
ApplicationType WebApplication
Platform Python/Flask/Ubuntu14.04.2LTS/Linux3.14.36(grsec)
EngagementSummary
Dates May24,2015– June5,2015
ConsultantsEngaged 2
TotalEngagementEffort 4personweeks
EngagementType ConfigurationReview&ApplicationPenetrationTest
TestingMethodology WhiteBox
VulnerabilitySummary
TotalHighseverityissues 0
TotalMediumseverityissues 1
TotalLowseverityissues 2
TotalInformationalseverityissues 7
Totalvulnerabilitiesidentified: 10
Seesection3.1onpage12fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 0
AuditingandLogging 1 (cid:4)
Authentication 1 (cid:4)
Configuration 4 (cid:4)(cid:4)(cid:4)(cid:4)
Cryptography 1 (cid:4)
DataExposure 1 (cid:4)
DataValidation 0
DenialofService 1 (cid:4)
ErrorReporting 0
Patching 0
SessionManagement 0
Timing 1 (cid:4)
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page6of26
1.1 iSEC Risk Summary
TheiSECPartnersRiskSummarychartevaluatesvulnerabilitiesaccordingtorisk. Theimpactofthe
vulnerabilityincreasestowardsthebottomofthechart. Thesophisticationrequiredforanattacker
tofindandexploittheflawdecreasestowardstheleftofthechart. Thecloseravulnerabilityistothe
chartorigin,thegreatertherisk.
• Journalist login enumeration
• Sessions are not invalidated upon logout
w
o
L
• HTTP for Ubuntu packages exposes
k unnecessary attack surface
s
i
R
s
s
e
n
i
s
u
B
h
g
iH
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page7of26
1.2 Project Summary
TheOpenTechnologyFund(OTF)engagediSECPartners(iSEC)toperformasource-assistedsecurity
reviewoftheFreedomofthePress'SecureDrop,awhistleblowersubmissionsystem. Thereviewwas
performedbytwoconsultantsduringtheweeksofMay25th andJune1st. Anadditionalconsultant
assistedthereviewonapro-bonobasistheweekofJune1st.
Thegoalofthisengagementwastoreviewthechangessincethe0.3preversionfollowingtheprevious
year's security audit.1 Particular items called out for review included the rewrite of the journalist
authenticationbackendandhardening,includingthetransitionfromshellscriptstoAnsibleplaybooks
andtheuseofaGrsecurityLinuxkernel.
Freedom of the Press (FPF) technical contacts met with the iSEC team in iSEC's New York office to
discusschangessincethelastreviewintheweekbeforetheengagement.Additionally,anFPFtechnical
contactmetwiththeiSECteamtoassistinsettingupvirtualenvironmentsfortesting. TheFPFteam
madethemselvesavailabletoanswerquestions, resolveissues, andengaginginongoingdiscussions
regardingrecommendationsandbestpractices,contributinggreatlytothesuccessofthisengagement.
Inlinewiththechangessince0.3pre,iSECfocusedontraditionalwebapplicationtestingofthenew
journalistinterface,whichhasanadministratorinterfaceandusestwo-factorauthenticationforusers.
iSECalsoperformedareviewoftheenvironmentinwhichSecureDroprunson,focusingoncovering
thefirewallconfiguration,ahostreviewoftheGrsecurityconfiguration,andotherhardeningproce-
duressuchastheSecureTempFileimplementationthatpreventsplaintextsubmissiondatafrombeing
bufferedtodisk.
InaccordancewithSecureDrop'sthreatmodel,2 attacksonthehardwareonwhichSecureDropruns
onaswellasattacksontheTornetwork(e.g. side-channel/deanonymizationattacks)wereconsidered
outofscope.
1.3 Findings Summary
SecureDrop'sextensivehardeningplacesitwellaboveindustrystandardsduetoitsemphasisonsecu-
rityandprivacy. Overall,thenewlyintroducedcomponentsdonotaddtothealreadylimitedattack
surface,astheSecureDroparchitectureremainsthesame. TheadditionofaGrsecurity-enabledkernel
significantlyraisesthebarforattackerswhomanagetosuccessfullyexploittheapplicationservervia
variousmemorycorruptionstyleattacks. Additionally, allinterfacesexcepttheoneusedbysources
areonlyavailableoverauthenticatedTorhiddenservices.3 Thesefactors,combinedwithSecureDrop's
existingdefenseindepthmeasures,maketraditionalformsofservercompromisesignificantlydifficult.
Inthedocumentinterface,iSECfoundthatsessionidentifiersarenotinvalidatedafterlogout;thisis
asideeffectofFlask'sclient-sidesessionsandnotintroducedbytheSecureDropcodeitself. However,
theuseofTorBrowserBundlewithanauthenticatedTorhiddenservicetoaccessthisinterfacemeans
it'shighlyunlikelyforthenecessaryconditionstooccurthatwouldallowasessionhijackingattack.
Inthisreport,iSEChasincludedseveralfindingsaffectingthenewjournalistauthenticationbackend.
Althoughthisbackendwouldbedifficulttoexploit,anattackermaybeabletoenumeratethejournalist
usernamesaswellascreateadenialofserviceconditionbysubmittingabnormallylargepasswordsin
1https://freedom.press/blog/2015/03/announcing-securedrop-0.3
2https://github.com/freedomofpress/securedrop/blob/0.3.3/docs/threat_model.md
3ThesourceinterfaceisalsoavailableviaaTorhiddenservice;however,thisinterfaceisnotanauthenticatedhiddenservice.
December8,2015 FreedomofthePress Version1.2
iSECPartnersFinalReport—FreedomofthePressSecureDrop Page8of26
the login form. Some debug statements were also left in the production code, potentially leaking
plaintextpasswordstologs.
ThroughouttheSecureDropenvironment,iSECnotedconfigurationpatternsrelatedtoiptablesrules
whicharelikelytointroduceunintendedeffects,andanunrelatedinstanceofani