Open Whistleblowing Framework Design and Arcitecture Review
Total Page：16
File Type：pdf, Size：1020Kb
GlobaLeaks - Open Whistleblowing Framework Design and Arcitecture Review Prepared for: Prepared by: Aaron Grattafiori — Security Engineer Alex Garbutt — Security Engineer Justin Engler — Security Engineer Gabe Pike – Security Engineer iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 2 of 24 ©2013, iSEC Partners, Inc. Prepared by iSEC Partners, Inc. for GlobaLeaks. Portions of this document, and the templates used in its produc- tion are the property of iSEC Partners, Inc. and can not be copied without permission. While precautions have been taken in the preparation of this document, iSEC Partners, Inc, the publisher, and the author(s) assume no responsibility for errors, omissions, or for damages resulting from the use of the information contained herein. Use of iSEC Partners services does not guarantee the security of a system, or that computer intrusions will not occur. February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 3 of 24 Document Change Log Version Date Change 0.1 2013-02-07 DRAFT document created 0.1 2013-02-07 DRAFT document sent PGP encrypted to Fabio Pietrosanti. 0.2 2013-02-08 DRAFT document ready for review. 0.5 2013-01-08 Peer reviewed by Tim Newsham and Loic Simon. 1.0 2013-01-08 Ready for GlobaLeaks 1.0 2013-01-08 Final document sent PGP encrypted to Fabio Pietrosanti. February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 4 of 24 Table of Contents 1 Engagement Structure ..................................................... 6 1.1 Internal and External Teams ................................................... 6 1.2 Project Goals and Scope ....................................................... 7 2 Executive Summary ........................................................ 8 3 Project Summary ........................................................... 9 3.1 Core Findings ................................................................ 9 4 Architecture and Design Overview ........................................ 10 4.1 Actors ....................................................................... 10 4.2 Assets ....................................................................... 10 4.3 Activities .................................................................... 11 4.4 Scenarios .................................................................... 11 4.5 Core GlobaLeaks Components .................................................. 12 4.6 GlobaLeaks Privacy and Anonymity ............................................. 12 4.7 GlobaLeaks Security and Authentication ......................................... 13 5 Scenario Diagrams ......................................................... 14 5.1 Whistleblower ............................................................... 14 5.2 Receiver ..................................................................... 15 5.3 Admin ...................................................................... 16 6 Design Risks and Concerns ................................................ 17 6.1 Actors ....................................................................... 17 6.2 GL Client .................................................................... 17 6.3 GL Backend .................................................................. 18 7 Design Recommendations ................................................. 20 7.1 Anonymity and Confidentiality ................................................. 20 7.2 GL Client .................................................................... 20 7.3 GL Backend .................................................................. 21 8 Attack Trees ................................................................ 23 February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 5 of 24 8.1 Denial of Service Attack Tree ................................................... 23 8.2 Anonymity Attack Tree ........................................................ 23 8.3 Web Application Attack Tree ................................................... 24 8.4 Network Attack Tree .......................................................... 24 February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 6 of 24 1 Engagement Structure 1.1 Internal and External Teams The iSEC team has the following primary members: • Aaron Grattafiori — iSEC Technical Lead [email protected], (707) 484–4223 • Alex Garbutt — iSEC Security Engineer [email protected], (415) 305–1598 • Justin Engler — iSEC Security Engineer [email protected] • Gabe Pike — iSEC Security Engineer [email protected] • Tom Ritter — iSEC Account Contact [email protected], (908) 838–7002 • Michael Reisinger — iSEC Project Manager [email protected], (818) 624–5344 The GlobaLeaks team has the following primary members: • Fabio Pietrosanti — GlobaLeaks [email protected] • Arturo Filastò — GlobaLeaks [email protected] • Claudio Agosti — GlobaLeaks [email protected] • Giovanni Pellerano — GlobaLeaks [email protected] • Yvette Agostini — GlobaLeaks [email protected] February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 7 of 24 1.2 Project Goals and Scope The goal of this engagement was to review the design of Globaleaks 2.0. This included reviewing the provided documents (listed below) for security risks, privacy leaks and potential design flaws such as: • Improper use of Tor • Anonymity leaks by various technologies used by GlobaLeaks • Exposure of confidential data to unauthorized actors • Weaknesses in protections from common web application vulnerabilities • Unidentified threats • Unidentified risks of design iSEC was provided with the following documents during the project: • ``GlobaLeaks Application Security Design and Details,'' Release 0.1 • ``GlobaLeaks Threat Model and Security Design,'' Release 0.1 • A basic architecture diagram titled ``image0001.png.'' • Responses to questions midweek: ``iSec GlobaLeaks Questions 1.'' February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 8 of 24 2 Executive Summary Application Summary Application Name Open Whistleblowing Framework Application Version 0.2 Open-Source Whistleblowing Platform for media organiza- Application Intent tions, activist groups, corporations and public agencies. Engagement Summary Dates February 4, 2013 – February 8, 2013 Consultants Engaged 2 Total Engagement Effort Two person weeks Engagement Type Design and Arcitecture Review Testing Methodology White Box Sections included within this document: Title, Section and Contents Architecture Overview within section 4 contains a description of Actors, Assets and Components. Scenario Diagrams within section 5 include diagrams for the Scenarios and Actors. Design Concerns within section 6 identify Risks, Concerns and Recommendations. Design Recommendations within section 6 contains recommendation for the design. Attack Trees within section 8 for DoS attacks, Anonymity and other Components. February 8, 2013 GlobaLeaks Confidential Version 0.1 iSEC Partners Final Report — GlobaLeaks - Open Whistleblowing Framework Page 9 of 24 3 Project Summary iSEC Partners was engaged by GlobaLeaks, to perform a security review of the upcoming v0.2 open whistleblowing platform. This was performed as part of a wider effort funded by Radio Free Asia (RFA) and delivered by iSEC Partners. Work was primarily performed by two iSEC consultants over the period of a single week, although two additional consultants joined in for additional review without cost to GlobaLeaks or RFA. iSEC was initially provided with a design and threat model documents for review, in addition to a basic system diagram. The iSEC team then formulated some initial questions and potential suggestions which were sent over to GlobaLeaks early in the week. Responses to these questions were provided by the GlobaLeaks team, helping to clarify the understanding of the product and gauging the acceptability of proposed suggestions; a very helpful contribution in the overall effort. Further information about the scope of this project can be found in section 1.2 on page 7. It should be noted that several core GlobaLeaks architecture technologies were not adequately defined or yet developed, such as the GlobaLeaks client (GL Client) deployment, Receiver notification process and Node administration. Several core issues powering the GlobaLeaks design were also out of scope for this assessment. This includes technologies such as Tor and Tor Hidden Services (Tor HS) or scenarios which require out-of-band authentication of Receivers and out-of-band communication of essential information such as the location (onion address) of an unpromoted GlobaLeaks Node. 3.1 Core Findings Overall, the security design is robust and threat model is accurate. Strong input validation, authenti- cation and access control related considerations are also present within the architecture. iSEC security engineer Tom Ritter has developed a ``cheatsheet'' for auditing technologies1 such as GlobaLeaks and was helpful in this assessment. Tor and Tor location-hidden services provide for Anonymity, a key concern in the platform. These tech- nologies,2 while still considered experimental,