OSSEC and/or Journalist alert SMTP account credentials compromised partially mitigated

THREAT69 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:1216

Risk: Low impact × Low likelihood = 2 low
After mitigations: Low impact × Low likelihood = 2 low (unchanged)

How statuses and scores work

Can send out arbitrary OSSEC and/or Journalist alert emails

Threat actors: Nation State / Law Enforcement Large Corporation

Mitigations

Mitigation	Status
OSSEC emails are gpg encrypted MITIG235	implemented
OSSEC emails should be signed MITIG236	proposed

Possible further mitigations

Use Signal for OSSEC alerts MITIG237 proposed

Where it applies

Applies to 2 components in 2 scenarios.

Journalist Corporate Workstation News Organization
Postfix Monitoring Server

Monitoring & alerting · Postfix

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_OSSEC_client_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC client";
            URL = "component_OSSEC_client.html";
            tooltip = "OSSEC client";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

        component_Postfix_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Postfix";
            URL = "component_Postfix.html";
            tooltip = "Postfix";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_OSSEC_client_Application_Server -> component_OSSEC_server_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Ship events";    ]
    component_OSSEC_server_Monitoring_Server -> component_Postfix_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Raise alert";    ]
    component_Postfix_Monitoring_Server -> component_SMTP_relay_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Relay mail";    ]
    component_SMTP_relay_External_Services -> actor_Administrator_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Deliver to admin";    ]
}

Corporate and legal zone · Journalist Corporate Workstation

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_News_Organization {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>News Organization</i>>;
        ]

        component_Journalist_Corporate_Workstation_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nCorporate\nWorkstation";
            URL = "component_Journalist_Corporate_Workstation.html";
            tooltip = "Journalist Corporate Workstation";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_News_Organization___Legal_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "News\nOrganization /\nLegal";
            URL = "component_News_Organization___Legal.html";
            tooltip = "News Organization / Legal";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "1. Journalist uses\ncorporate device";    ]
    component_SMTP_relay_External_Services -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "2. Alerts to\ncorporate mail";    ]
    component_Journalist_Corporate_Workstation_News_Organization -> component_News_Organization___Legal_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "3. Organizational /\nlegal exposure";    ]
}

Notes

Existing mitigations: Emails are GPG-encrypted to provide confidentiality (MITIG235). However, they are not signed, therefore they can be spoofed. Email account may also be used to phish administrators with links (MITIG236). Further mitigations: Admin users should not open any links contained in any emails, including the ossec alert folder. Use Signal for ossec alerts (MITIG237). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.