Replies: 3 comments 2 replies
-
Implementation QuestionsHow to neutralize a file?Some idea exploration in freedomofpress/securedrop-workstation#1139 How to embed arbitrary data in documents?It turns out that PDFs are pretty flexible. Due to way they are parsed, it is possible to include arbitrary data which does not affect the viewing experience. A great example is the PoC||GTFO magazine which is a PDF which sometimes doubles-up as a zip file (including source code demos) or even a git repo 🤯. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, and thanks for this discussion. My first reaction is: "but if we embed the document, could that be an attack vector?" In other words, how can we be sure that this document is actually "made harmless"? Also, when you say "should the journalist want to recover the original file", is it a request you got from somebody? |
Beta Was this translation helpful? Give feedback.
-
As long as the attacker has no control over the final output, then I think it can be considered harmless. A simple idea is to xor the file with a random key (and random length) and then embed in the sanitized file the key and the xored original. Although this naive idea would need validation. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
(originally posted in simplifying save options #427. Moving it here so it gets its dedicated discussion space)
This idea is a recognition of the two features Dangerzone has:
New Operating Mode: Preserve Original
This proposal consists of adding a second operating mode, which includes / embeds the original document inside the safe version but in a way that makes it harmless. This way the document could safely be opened. Should the journalist want to recover the original file, they could recover it using Dangerzone.
Why is this important?
Currently, Dangerzone fully removes document metadata and it becomes hard to manage what is original and what is sanitized. Specifically thinking about the SecureDrop Workstation, when Dangerzone is integrated, newsrooms may prefer to share the sanitized version with colleagues on non-Qubes laptops. But this would also create a document management problem: where to store the original for accountability and further investigation? Should is also be included, but in an
unsafefolder?By embedding the document, it becomes a matter of just managing one document, which can safely be opened, yet with the original a deconversion away, which would not need a specialized machine for. Just Dangerzone.
What could this look like in practice?
On the left is the new mode of operation and on the right, the traditional mode
Here's a breakdown of what each option does:
Warning document cover (optional)
A cover page could be added to the document to explain the following:
Limitations
This approach does not consider the case where Dangerzone cannot create a sanitized version. One solution could be to simply fail. Another could be to return a single Dangerzone cover page indicating that the file could not be converted but the original is preserved inside.
Beta Was this translation helpful? Give feedback.
All reactions