Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

SecureDrop Workstation Gets Post-Audit Security Refresh

The open-source SecureDrop Workstation has undergone a security makeover after a third-party security audit flagged multiple problems, including a high-risk bug that could allow an attacker to plant files on target machines.

The open-source SecureDrop Workstation has undergone a security makeover after a third-party security audit flagged multiple problems, including a high-risk bug that could allow an attacker to plant files on target machines.

The SecureDrop Workstation audit, conducted by Trail of Bits and financed by the New York Times, warned that the high-risk directory traversal bug could be leveraged for code execution attacks.

“The high severity finding details case where a malicious SecureDrop server could create files in arbitrary paths in the sd-app VM, which may allow for a code execution,” according to the audit report [PDF].

“When the SecureDrop Workstation client downloads a file, it stores it in a location derived from the filename returned by the server. However, since this location is not sanitized properly in all cases, an attacker who controls responses from the server can make the client save files in arbitrary paths on the filesystem. An attacker can use this vulnerability to plant files that potentially enable further vulnerabilities.”

The Trail of Bits code auditors found two cases when a malicious SecureDrop server could plant files.

Overall, the security assessment gave SecureDrop workstation a positive security bill of health. 

“We were unable to achieve a direct compromise of the Workstation from the position of an Internet-based attacker during our engagement,” Trail of Bits said, but made it clear this doesn’t imply that such a compromise exists or that SecureDrop Workstation is free of bugs.

SecureDrop Workstation is currently managed by the Freedom of the Press Foundation. Based on Qubes OS, the platform enables secure and encrypted communications between news organizations, journalists, sources and whistleblowers. It is currently being used in a limited pilot.

The Foundation said the audit report confirmed some its  assumptions around the use of virtualization to segment sensitive workloads and was pleased with the finding that the system system “represents a complex but well researched product that has been thoughtfully designed.”

None of the issues identified were directly exploitable by an attacker, and require either compromise of the SecureDrop server, or code execution in certain key VMs within the SecureDrop Workstation, the Foundation said.

Over the course of their engagement (6 person-weeks with two pen-test/code audit engineers), Trail of Bits found and documented 1 high-risk, 6 medium-risk, 7 low and 12 informational disclosure problems.

The audit confirmed that the high-severity and six of the medium-severity issues have already been patched and released, with the fixes validated by the auditing team. 

The Foundation said it is also investigating potential architectural improvements, including the creation of a custom RPC service to handle opening of files.

“In addition to addressing the findings surfaced in this report, we are also implementing feedback from current pilot participants, and planning new features around export and integration to other communication tools. We are in the process of expanding the pilot to several other news organizations, and hope to provide general availability later this year,” the Foundation said.

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.