Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Leaking OTP in Hadoop plugin #3296

Closed
5 tasks
ilija-lazoroski opened this issue May 3, 2023 · 3 comments · Fixed by #3298
Closed
5 tasks

Leaking OTP in Hadoop plugin #3296

ilija-lazoroski opened this issue May 3, 2023 · 3 comments · Fixed by #3298
Labels
Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Complexity: Low Impact: High Security
Milestone

Comments

@ilija-lazoroski
Copy link
Contributor

ilija-lazoroski commented May 3, 2023

Describe the bug

It seems that we are leaking OTP in Hadoop payload logging

To Reproduce

Steps to reproduce the behavior:

  1. Configure the Monkey with Hadoop plugin
  2. Run the monkey on any hadoop machine
  3. Observe logs

Expected behavior

We shouldn't be logging OTP.

Screenshots

image

Machine version (please complete the following information):

  • OS: Windows or Linux

Tasks

  • Fix up logging level in Hadoop plugin
    • Do not forget to rebuild the plugin
  • Fix the regex in OTPFormatter
    • Store the OTP character set in common and use it in OTPFormatter and AuthenticationFacade.generate_otp()
    • Compile regexes as class variables so they don't need to be recompiled for every single log message
@ilija-lazoroski ilija-lazoroski added Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Impact: Critical Complexity: Low labels May 3, 2023
@ilija-lazoroski ilija-lazoroski added this to the v2.2.0 milestone May 3, 2023
@shreyamalviya
Copy link
Contributor

The regex in OTPFormatter needs to be fixed.

@mssalvatore
Copy link
Collaborator

We should also consider modifying the plugin to not leak this in the first place.

@mssalvatore
Copy link
Collaborator

The regex in OTPFormatter needs to be fixed.

A few improvements that can be made:

  1. Store the OTP character set somewhere in common so the regex and the generate_otp() function are kept in sync
  2. Compile the regexes once as a class variables, instead of every time the format() function is called.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug An error, flaw, misbehavior or failure in the Monkey or Monkey Island. Complexity: Low Impact: High Security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants