SMTP relay compromised partially mitigated

THREAT71 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:1251

Risk: Low impact × Low likelihood = 2 low
After mitigations: Low impact × Low likelihood = 2 low (unchanged)

How statuses and scores work

Can send out arbitrary OSSEC and/or Journalist alert emails, read all incoming/outgoing emails except for OSSEC/Journalist alerts which are encrypted. Can cause denial of service and prevent OSSEC and/or Journalist alerts from being sent. An attacker may also obtain email addresses and identity of the SecureDrop instance administrators and journalsits, as well as some metadata on SecureDrop instance health and existence of new submissions to the Source Interface.

Mitigations

Mitigation	Status
OSSEC emails are gpg encrypted MITIG235	implemented
OSSEC emails should be signed MITIG236	proposed

Possible further mitigations

Use Signal for OSSEC alerts MITIG237 proposed

Residual risk

Furthermore, if the SMTP relay suffers a denial-of-service attack, OSSEC alerts may not be delivered to administrator(s).

Where it applies

Applies to 1 component in 2 scenarios.

SMTP relay External Services

Monitoring & alerting · SMTP relay

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_OSSEC_client_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC client";
            URL = "component_OSSEC_client.html";
            tooltip = "OSSEC client";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

        component_Postfix_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Postfix";
            URL = "component_Postfix.html";
            tooltip = "Postfix";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_OSSEC_client_Application_Server -> component_OSSEC_server_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Ship events";    ]
    component_OSSEC_server_Monitoring_Server -> component_Postfix_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Raise alert";    ]
    component_Postfix_Monitoring_Server -> component_SMTP_relay_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Relay mail";    ]
    component_SMTP_relay_External_Services -> actor_Administrator_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Deliver to admin";    ]
}

Corporate and legal zone · SMTP relay

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_News_Organization {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>News Organization</i>>;
        ]

        component_Journalist_Corporate_Workstation_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nCorporate\nWorkstation";
            URL = "component_Journalist_Corporate_Workstation.html";
            tooltip = "Journalist Corporate Workstation";
            margin = 0.02;
        ]

        component_News_Organization___Legal_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "News\nOrganization /\nLegal";
            URL = "component_News_Organization___Legal.html";
            tooltip = "News Organization / Legal";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "1. Journalist uses\ncorporate device";    ]
    component_SMTP_relay_External_Services -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "2. Alerts to\ncorporate mail";    ]
    component_Journalist_Corporate_Workstation_News_Organization -> component_News_Organization___Legal_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "3. Organizational /\nlegal exposure";    ]
}

Notes

Existing mitigations: Emails are GPG-encrypted to provide confidentiality (MITIG235). However, they are not signed, therefore they can be spoofed. (MITIG236). Further mitigations: Move Ossec alerts to Signal (MITIG237). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.