Use ICMP instead of HTTP for testing the connection

[d35ha]

[sara-rn]

I tested locally and it works as expected. As suggested by @Ana06 it is not known why this implementation poses an advantage over HTTPS

[Ana06]

@sara-rn you also tested the change. Did you also get the noise in fakenet?

[d35ha]

@d35ha thank you for the changes! I appreciate the documentation addition and the detailed commit description.

I have done some more testing and this change is very noisy in fakenet:

It seems the ProcessBlackList: internet_detector.exe fakenet exclusion is not working properly for ICMP. The HTTP communication was excluded from the output, while ICMP is still there. @d35ha can you reproduce this? Am I doing something wrong?

@Ana06 I noticed the same noise, not sure why fakenet is unable to identify the source process (maybe related to https://github.com/mandiant/flare-vm/pull/630).

[d35ha]

@d35ha thank you for the changes! I appreciate the documentation addition and the detailed commit description. I have done some more testing and this change is very noisy in fakenet: It seems the ProcessBlackList: internet_detector.exe fakenet exclusion is not working properly for ICMP. The HTTP communication was excluded from the output, while ICMP is still there. @d35ha can you reproduce this? Am I doing something wrong?

@Ana06 I noticed the same noise, not sure why fakenet is unable to identify the source process (maybe related to mandiant/flare-vm#630).

It seems that fakenet failes to (or doesn't) identify the source process for the ICMP requests.

[Ana06]

@d35ha I think it is not related to https://github.com/mandiant/flare-vm/pull/630 as fakenet does ignore the process when using HTTP. I think the issue is how fakenet is implemented. When @emtuls first implemented the internet detector using HTTP requests we realised the process was not being ignored: https://github.com/mandiant/flare-fakenet-ng/issues/190. Supporting ignoring HTTP requests coming from a black listed process required structural changes in fakenet implemented in https://github.com/mandiant/flare-fakenet-ng/pull/192. It seems that we now have the same issue with ICMP and this would requiring modifying fakenet again, not sure if it is even possible. :thinking:

[Ana06]

PR to add ICMP ID-based filtering in fakenet that allows us to ignore the ICMP traffic from the internet detector: https://github.com/mandiant/flare-fakenet-ng/pull/204

[Ana06]

We would still need to adapt this PR after https://github.com/mandiant/flare-fakenet-ng/pull/204 has been merged to add the ID, @d35ha do you plan to do this now to illustrate how this is exactly implemented (concretely how the ID is generate), which will help understanding what we want to address with https://github.com/mandiant/flare-fakenet-ng/pull/204 (and may help with the PR review)? Or are you planning to wait for feedback on https://github.com/mandiant/flare-fakenet-ng/pull/204 before making changes here?

[d35ha]

@Ana06

Now the fakenet filter is enabled from the tool side, the only thing we are waiting for is https://github.com/mandiant/flare-fakenet-ng/pull/204 to be approved.

[Ana06]

@d35ha fakenet has been released and updated in VM-Packages. Please rebase and ensure the code works with the new fakenet version and the linter is happy. :wink:

[d35ha]

@Ana06 rebased and successfully tested.

[sara-rn]

I tested locally and I realized that this issue https://github.com/mandiant/VM-Packages/pull/1261#issuecomment-2633106481 still persists, shouldn't be Fakenet able to identify the source process for the ICMP requests?

[d35ha]

I tested locally and I realized that this issue #1261 (comment) still persists, shouldn't be Fakenet able to identify the source process for the ICMP requests?

@sara-rn please make sure fakenet 3.5 is installed and 3.3 is totally removed (from C:\Tools\fakenet\fakenet3.3) as fakenet.vm will pick the old version if exists:

https://github.com/mandiant/VM-Packages/blob/d7e532fe2193e2d2a51f58bf5c6bf8eb6b12044a/packages/fakenet-ng.vm/tools/chocolateyinstall.ps1#L31-L32

[Ana06]

@d35ha

@sara-rn please make sure fakenet 3.5 is installed and 3.3 is totally removed (from C:\Tools\fakenet\fakenet3.3) as fakenet.vm will pick the old version if exists

Can we modify fakenet.vm to take the latest instead of the oldest version instead? That would avoid this type of issues.

[d35ha]

@d35ha

@sara-rn please make sure fakenet 3.5 is installed and 3.3 is totally removed (from C:\Tools\fakenet\fakenet3.3) as fakenet.vm will pick the old version if exists

Can we modify fakenet.vm to take the latest instead of the oldest version instead? That would avoid this type of issues.

Modified it.

[Ana06]

@sara-rn can you please test it again? :smile:

[sara-rn]

tested locally, LGTM, thanks @d35ha great job