Scenario: release_basic

Threat model for Dangerzone

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Create GitHub\nrelease";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Update release\nreference";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant External_github_repositories as External github repositories
    link External_github_repositories: Component @ component_External_github_repositories.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>External_github_repositories: 3. Download embedded assets
    Build_machines->>Build_machines: 4. Build DZ binaries
    Build_machines->>DZ_Linux_package_server: 5. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 6. Create GitHub release
    dev->>dangerzone_rocks: 7. Update release reference

Show data flows

ID	Name	Source	Sink	Type
1	Kick off release build	dev	Build machines	Request
2	Build and publish signed container image	Build machines	GitHub Container Registry	Request
3	Download embedded assets	Build machines	External github repositories	Request
4	Build DZ binaries	Build machines	Build machines	Request
5	Push signed builds to Linux repos	Build machines	DZ Linux package server	Request
6	Create GitHub release	Build machines	DZ GitHub repo	Request
7	Update release reference	dev	dangerzone.rocks	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-DEPS		Build machines	verifies resources.deps
CAPEC-145	Checksum Spoofing	Build machines	uses strong crypto
CAPEC-439	Manipulation During Distribution	External github repositories	is verifiable
CAPEC-439	Manipulation During Distribution	dangerzone.rocks	is verifiable
CAPEC-440	Hardware Integrity Attack	Build machines	is verifiable
CAPEC-473	Signature Spoof	Build machines	uses strong crypto
CAPEC-582	Route Disabling	Build machines	works offline
CAPEC-582	Route Disabling	GitHub Container Registry	works offline
CAPEC-582	Route Disabling	External github repositories	works offline
CAPEC-582	Route Disabling	DZ Linux package server	works offline
CAPEC-582	Route Disabling	DZ GitHub repo	works offline
CAPEC-582	Route Disabling	dangerzone.rocks	works offline
CAPEC-639	Probe System Files	GitHub Container Registry	is sandboxed
CAPEC-639	Probe System Files	DZ container image	is sandboxed
CAPEC-639	Probe System Files	External github repositories	is sandboxed
CAPEC-639	Probe System Files	Embedded Sandbox	is sandboxed
CAPEC-639	Probe System Files	DZ Linux package server	is sandboxed
CAPEC-639	Probe System Files	DZ release binary	is sandboxed
CAPEC-639	Probe System Files	Release Signature Data	is sandboxed
CAPEC-639	Probe System Files	DZ GitHub repo	is sandboxed
CAPEC-639	Probe System Files	dangerzone.rocks	is sandboxed
CAPEC-639	Probe System Files	Release reference	is sandboxed

Back to Summary