Add internet detector utility #1121
Conversation
|
How does this script interact with FakeNet? Should FakeNet be handled specifically? |
If fakenet response is the one we would get with internet, our tool (as other programs like malware) thinks the internet is on. The default fakenet response shouldn't match the ones we are expecting, so without modifying the default fakenet configuration, it will think there is no internet. @mr-tz do you have a proposal to improve the implementation? What do you exactly mean with handling fakenet specifically? Note: I think this tool could be hosted in the fakenet repository and even been part of fakenet, it would need to be discussed with the fakenet maintainers to see if it is feasible once we have a working and tested version. |
|
I'd expect it to not warn users that the Internet is reachable if FakeNet is running. |
emtuls
force-pushed
the
internet-detector
branch
from
c6c2aed
to
dd7fd97
Compare
|
This raises a good thought. While the tool works with FakeNet active, you would see a lot of requests generated in order for the tool to function promptly. We can potentially reduce the request interval, but this would cause a delay in detecting internet which is a trade-off we need to consider. What interval would be fair enough to detect a real internet connection in enough time for a user to be aware while also not being too intrusive in a FakeNet output? Also note, due to adding backup internet connectivity URL's, there are now multiple requests that are issued consecutively, rather than a single one. |
emtuls
force-pushed
the
internet-detector
branch
2 times, most recently
from
0df911b
to
d142d11
Compare
|
I was able to remove the |
emtuls
force-pushed
the
internet-detector
branch
from
d142d11
to
4549599
Compare
|
Added nicer tooltips that explain what the icons mean: "Internet Detected" vs "Internet Not Detected" |
emtuls
force-pushed
the
internet-detector
branch
2 times, most recently
from
9fceab4
to
b12faaf
Compare
|
I remember some filtering work FakeNet did on Internet connectivity checks to reduce noise. Maybe @tinajohnson can chime in on this? I'm not sure what a good interval would be, maybe 20 seconds? |
We can use the fakenet listener filtering by ensuring the process name has a unique name. We can do this either in fakenet or in the tool package (that should be added to this PR too) |
emtuls
force-pushed
the
internet-detector
branch
3 times, most recently
from
394cfd5
to
68bf888
Compare
|
Chatting with FakeNet team, it sounds like we can add the tool to "Diverter's ProcessBlackList and HTTPListener's ProcessBlackList": |
|
I also updated the tool to use a pink icon when internet is active and gray when not, as well as convert everything over to a VM Package and have it install a scheduled task to run every 2 minutes. It is a |
emtuls
force-pushed
the
internet-detector
branch
2 times, most recently
from
871bbf1
to
593bdaa
Compare
|
Also note, this will fail to pass the |
emtuls
force-pushed
the
internet-detector
branch
3 times, most recently
from
b1a6741
to
a5a7a32
Compare
There was a problem hiding this comment.
Great work @emtuls 🎉
Just some minor improvement suggestions 😉
-
can we change the pink icon to have more contrast with the pink taskbask? (for example with a more intense/lighter pink) it is a bit difficult to see when it is hidden and it does not hurt when it is not:
-
it would be nice that the icon is always visible. It seems I can move it manually to the taskbar and then it stays there. It would be nice if the tool could place it there. I propose you open an issue your this and research if it is possible after this PR has been merged. As it can be placed manually in the taskbar, I do not consider this a blocker and I would like to start using the tool! 🎉
emtuls
force-pushed
the
internet-detector
branch
from
a5a7a32
to
272fac7
Compare
I have updated it to just use the colored version, which I think looks great with the pink taskbar. Unfortunately, I don't think there's a way to force the icon to stay on the tray in the taskbar...For me, it starts there, but sometimes gets moved, but it can be moved back down manually. Couldn't find any way to force it to stay on the bottom.
|
emtuls
force-pushed
the
internet-detector
branch
2 times, most recently
from
2ad703a
to
1d88d3b
Compare
emtuls
force-pushed
the
internet-detector
branch
4 times, most recently
from
571d770
to
b0c56b2
Compare
There was a problem hiding this comment.
If I have internet in the VM and I start fakenet, I expect the tool to keep showing me there is internet. But this is not the case at the moment (both with and without the config file). Is this the fakenet bug reported in mandiant/flare-fakenet-ng#190?
| # $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2) | ||
| # Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'Internet Detector' -Force | ||
|
|
||
| # Copy updated `default.ini` with tool added to ProcessBlackList to FakeNet Config Directory |
There was a problem hiding this comment.
If fakenet is reinstalled (to update to a newer version for example) this change will be lost. So I think we should contribute explaining this is a temporary workaround in a TODO comment here and aim to contribute this change to fakenet soon.
There was a problem hiding this comment.
Alternatively (better more robust solution): Move this to our fakenet package in this PR.
We can still open the PR/issue in fakenet afterwards to discuss if porting the change upstream is an option, as otherwise we will have to keep this file in sync in our package which is not ideal.
emtuls
force-pushed
the
internet-detector
branch
4 times, most recently
from
dd87129
to
d24ab7f
Compare
Co-authored-by: Ana Martinez Gomez <[email protected]>
emtuls
force-pushed
the
internet-detector
branch
from
d24ab7f
to
bcd96b0
Compare
This adds a script to detect if internet connection is active or not by adding an icon in the taskbar and also changing the background based on if internet is detected or not.
This will also require an addition of a new python libraries to install:
pywin32