High-severity vulnerability found in SecureDrop system

Exploitation "would be incredibly difficult to pull off," the developers wrote.

A high severity vulnerability found in SecureDrop, a whistleblower submission system used by newsrooms and advocacy groups, prompted a patch from developers and coordination with dozens of prominent news organizations that use the software to communicate with sensitive sources.

The bug, blamed on developer error, leaves the system unable to verify key packages and can grant remote code execution against targets. Some SecureDrop users, including the New York Times, are reinstalling the software as part of a general update.

Other organizations “decided that the chance of an attack was so remote that they do not believe a reinstall is necessary,” SecureDrop developers explained.

The vulnerability has not been spotted in the wild and “would be incredibly difficult to pull off,” according to a bulletin posted on Tuesday afternoon.

While stressing the difficulty of exploitation, SecureDrop developers said it’s “likely that only a nation-state actor with network-level access would have the ability to conduct such a sophisticated man-in-the-middle attack to replace the affected packages with malicious code. Any attacker would also have had to have had invasive, targeted surveillance on either the news organization or Freedom of the Press Foundation to know exactly when the installation was occurring and be able to target that specific network, making the window for such an attack very narrow.”

It makes sense, then, that a target like the New York Times — which has repeatedly found itself to be targeted by nation-state adversaries — would take all precautions.

The Times’ Director of Information Security, Runa Sandvik, tweeted the company’s response on Tuesday. Facing a similar threat model, The Intercept followed suit and directed all sources to their newly updated and protected version of SecureDrop.

SecureDrop is open-source software designed to facilitate secure, anonymous communication between sources and journalists. The software is managed by the Freedom of the Press Foundation and it used at organizations including the New York Times, the Washington Post, the Guardian and the Intercept.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure