{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1330","repository_url":"https://api.github.com/repos/freedomofpress/securedrop","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1330/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1330/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1330/events","html_url":"https://github.com/freedomofpress/securedrop/issues/1330","id":160026426,"number":1330,"title":"Spurious OSSEC alerts due to THS port scanning","user":{"login":"garrettr","id":407302,"avatar_url":"https://avatars.githubusercontent.com/u/407302?v=3","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/freedomofpress/securedrop/labels/support-request","name":"support-request","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"fowlslegs","id":3538418,"avatar_url":"https://avatars.githubusercontent.com/u/3538418?v=3","gravatar_id":"","url":"https://api.github.com/users/fowlslegs","html_url":"https://github.com/fowlslegs","followers_url":"https://api.github.com/users/fowlslegs/followers","following_url":"https://api.github.com/users/fowlslegs/following{/other_user}","gists_url":"https://api.github.com/users/fowlslegs/gists{/gist_id}","starred_url":"https://api.github.com/users/fowlslegs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fowlslegs/subscriptions","organizations_url":"https://api.github.com/users/fowlslegs/orgs","repos_url":"https://api.github.com/users/fowlslegs/repos","events_url":"https://api.github.com/users/fowlslegs/events{/privacy}","received_events_url":"https://api.github.com/users/fowlslegs/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/13","html_url":"https://github.com/freedomofpress/securedrop/milestones/0.3.8","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/13/labels","id":1824365,"number":13,"title":"0.3.8","description":"Next point release for the 0.3.x release series. The roadmap has not been planned yet, but for now this will collect outstanding issues that have been identified as candidates for the next point release, typically due to their impact on end users such as admins and journalists.","creator":{"login":"garrettr","id":407302,"avatar_url":"https://avatars.githubusercontent.com/u/407302?v=3","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2016-06-13T19:30:54Z","updated_at":"2016-06-13T20:23:57Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-06-13T19:29:45Z","updated_at":"2016-06-14T01:02:03Z","closed_at":null,"body":"We received a report on our private support portal about frequent OSSEC alerts triggered by the following message in `/var/log/tor/log`:\r\n\r\n```\r\n[timestamp redacted] [warn] connection_edge_process_relay_cell (at origin) failed.\r\n```\r\n\r\nAfter enabling `info`-level logging for Tor, we were able to correlate this `[warn]`-level message with preceding `[info]`-level messages:\r\n\r\n```\r\n[timestamp redacted] [info] rend_service_set_connection_addr_port(): No virtual port mapping exists for port 443 on service qn4qfeeslglmwxgb\r\n[timestamp redacted] [info] connection_exit_begin_conn(): Didn't find rendezvous service (port 443)\r\n[timestamp redacted] [warn] connection_edge_process_relay_cell (at origin) failed.\r\n```\r\n\r\nThese messages are triggered by an attempt to open a connection to a hidden service on a port that it does not listen on (e.g. the Source Interface only listens on port 80, but these messages were triggered by attempts to connect on 443). You can easily reproduce it by trying to open a connection to a given hidden service on a port that it does not listen on.\r\n\r\nAt this point, we decided to analyze some of the logs from the Tor Hidden Services we operate (e.g. for our websites) using our new ELK stack, and found that we were seeing the same patterns.\r\n\r\nThese log messages appear to be caused by various automated crawlers that try various common \"ports of interest\" on publicly advertised hidden services (e.g. [OnionScan](https://github.com/s-rah/onionscan/blob/master/onionscan.go)). This type of crawling happens constantly and is usually benign (e.g. for research, testing new tools, etc.).\r\n\r\nSince this event is typically benign, it should *not* trigger dozens of OSSEC alerts a day. These alerts are spurious, waste admin's time and attention, and make it difficult to separate signal from noise in the alerts sent by OSSEC. I propose that we develop a mitigation to avoid sending spurious alerts and include it in the next point release (0.3.8)."},"comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments/225752684","html_url":"https://github.com/freedomofpress/securedrop/issues/1330#issuecomment-225752684","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1330","id":225752684,"user":{"login":"garrettr","id":407302,"avatar_url":"https://avatars.githubusercontent.com/u/407302?v=3","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"created_at":"2016-06-14T01:02:03Z","updated_at":"2016-06-14T01:02:03Z","body":"> since 0 is the default setting we should preserve it as an \"anti-fingerprinting\" measure.\r\n\r\nGood point @fowlslegs, that is another good reason to keep the default setting."}}
{"actor":{"display_login":"garrettr"}}