Skip to content

Remove "insecure access" feature #1418

@mssalvatore

Description

@mssalvatore

Infection Monkey stores very sensitive information (passwords, NTLM hashes, SSH keys, etc.) that could give someone access to large portions of the network. Further more, Infection Monkey allows you to configure it to run arbitrary scripts or executables on any system it can breach. This means Infection Monkey is a very dangerous tool for someone malicious to be able to access. For this reason, we should not allow users to configure unsecured Monkey Islands.

The "I want anyone to access the island" option should be removed.

image

Tasks

  • Remove StandardEnvironment in the agent and fix unit tests. (0d) - @shreyamalviya
  • Remove "I want anyone to access" in the frontend (button and setNoAuth()). (0d) - @shreyamalviya
  • Fix blackbox tests to use credentials. (0d) @ilija-lazoroski
  • Thorough testing. (0d)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions