cage-challenge-4 icon indicating copy to clipboard operation
cage-challenge-4 copied to clipboard

Phishing email ignoring traffic rules

Open jubois opened this issue 10 months ago • 1 comments

I noted that the phishing mails were "sent" to operational even if it was on a phase where operational couldn't be joined. It past throught the BlockTrafficZone action also. This issue seems to come from the check_routable function that ignore policy or firewall.

To reproduce, the seed 108 have a lot of phishing and I edited the policy function to return only policy_2. Blue is SleepAgent, Red is DiscoveryFSRed and Green is EnterpriseGreenAgent. Turn 15 should have a phishing mail in a host in operational zone A

For the firewall (if it's not intended) an addition of connection faillure flag like in efeb8c6 commit (lines 188 to 195) can patch this part of the issue. But there is an infinite loop in PhishingEmail.py. The infinite loop is like this, if there is no agent routable in the red_agents list, the list has a constant length so there is no termination condition in the while loop (lines 83 to 91), easy fix is to remove the r_agent from the red_agents list when it is not routable or to change the while to a for loop.

I can provide more detail on the firewall patch if wanted.

Thank you for your work

jubois avatar Apr 18 '24 13:04 jubois