guardicore / guardicore/monkey

Update machine OS if it's exploited with OS-specific exploiter

Open
#2,900 0 comments 0 reactions 0 assignees View on GitHub
Bug Complexity: Low Impact: Medium
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

When an Agent scans a machine, it sends an event to the Island which may or may not include that machine's OS. The Island upserts that machine in the machine repository.

If the OS is unknown at this point, the only time that it is updated again is when an Agent runs on that machine and sends an `OSDiscoveryEvent` to the Island. If the OS is `None`, the map in the UI doesn't show an accurate image for that node.

If the machine was exploited with an exploiter that only works for a specific OS, update the machine with the OS. This helps with cases where the machine was exploited and an Agent binary was downloaded to it, but no communication back to the Island happened (see #2901).

Example:
10.2.0.13 is Linux machine which was exploited by the SSH exploiter. An Agent binary was also downloaded to the machine (checked in the logs), however, it could not communicate back to the Island. The map node isn't accurate according to this information, since the OS information of the machine was never updated, it was always `None`.
![image](https://user-images.githubusercontent.com/44770317/215743367-fbff1535-6df1-4911-b45f-17228b99748a.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.