guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.68k stars 786 forks source link

Island: Add a small throttle to shorten the OTP #4188

Closed VakarisZ closed 5 months ago

VakarisZ commented 5 months ago

What does this PR do?

Part of #4187

Calculations

7 chars (alphanumeric + 3 special characters) gives total of 4,764,996,883,946 combinations (based on this The current throttle is 0.001, so the result is that you're able to check 120 000 passwords per 2 minutes. This means that you chance of guessing the OTP is 1 in 39,708,307. In practice it's much higher if you account for network latency. I think this is sufficient security for a problem whose real solution is NAC.

PR Checklist

codecov[bot] commented 5 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 77.06%. Comparing base (af54997) to head (cee2e2f).

:exclamation: Current head cee2e2f differs from pull request most recent head 3ccd633

Please upload reports for the commit 3ccd633 to get more accurate results.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## develop #4188 +/- ## ======================================== Coverage 77.06% 77.06% ======================================== Files 442 442 Lines 14125 14126 +1 Branches 18 18 ======================================== + Hits 10885 10886 +1 Misses 3240 3240 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.