guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.62k stars 772 forks source link

Fix security of credentials in config. #1172

Closed VakarisZ closed 3 years ago

VakarisZ commented 3 years ago

Describe the bug

Infection monkey shows/exports unencrypted credentials.

To Reproduce

Steps to reproduce the behavior:

  1. Enter passwords in the list
  2. See the passwords
  3. Export config
  4. Open exported file
  5. See plaintext passwords

Expected behavior

  1. On "Export config" click user get's a popup with explanation about sensitive credentials in config.
  2. User can either enter password to encrypt the config or export plaintext config (similar to registration/no password)
  3. On import island should detect if configuration is encrypted or plaintext. If encrypted, another pop-up for password.
  4. Exported config should be encrypted based on the password provided by the user.

Tasks

Mockups:

image

mssalvatore commented 3 years ago

Monkey Island should give the users the option to enter a password to encrypt the config export. On import, it would be ideal if the island could detect an encrypted config and prompt the user for the password[

VakarisZ commented 3 years ago

I feel like that's maybe a V2. Also, I'm not sure if entering a password on export/import is convenient, given the fact that the user is already authenticated and we can use authentication data as a secret without a prompt.

VakarisZ commented 3 years ago

Me and Mike decided that it's not worth encrypting with default credentials because configs will not be compatible among different installation