Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Local network scan" can scan over the internet #2299

Closed
7 tasks done
mssalvatore opened this issue Sep 15, 2022 · 0 comments
Closed
7 tasks done

"Local network scan" can scan over the internet #2299

mssalvatore opened this issue Sep 15, 2022 · 0 comments
Labels
Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Complexity: Low Impact: Critical

Comments

@mssalvatore
Copy link
Collaborator

mssalvatore commented Sep 15, 2022

Describe the bug

The option to scan local networks in network configuration could allow Infection Monkey to scan and attempt to exploit machines over the public internet. This risk needs to be obvious to the user.

Determining whether or not a network interface is connected to the public internet is not trivial. There are some simple steps we can take, but there is no formal definition of "public interface". The closest thing would be to only scan addresses in IPv4 the private ranges, but this may or may not be the user's desired behavior.

To resolve this issue, we will take the following steps

  1. Rename the option to make it clearer that public addresses can be scanned/exploited
  2. Disable the option by default
  3. Add an obvious warning icon and/or tool-tip explaining the risks associated with enabling the option
  4. Update the documentation to explain the risks associated with enabling the option

Tasks

  • Fix functionality (0d) @cakekoa
    • Change the option's name
    • Change the option's display name
    • Disable the option by default
  • Fix documentation
    • Add a tooltip and/or warning icon to the UI (0d) - @shreyamalviya
    • Update the documentation to explain the risks (0d) @cakekoa
@mssalvatore mssalvatore added Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Impact: Critical Complexity: Low labels Sep 15, 2022
mssalvatore added a commit that referenced this issue Sep 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Complexity: Low Impact: Critical
Projects
None yet
Development

No branches or pull requests

1 participant