I added a "join_multicast_group" function which creates a little
security problem IMHO.
The function opens a socket which must not be closed before we want to
leave the multicast group. But we have to close it at the end of the
script to avoid memory leak.
1. Allowing the script to write on the socket is not good, because
a. It breaks the NASL model where the script is supposed to connect
to the "target" only
b. A malicious script could send information out through it.
But with SMTP or NNTP, it is already possible to attack other machines
or leak information out.
=> I implemented a quick and dirty "jamming". A random value is added
to the socket number, so the descriptor cannot be used from the
script. A cleaner way to do it would be to keep an array of multicast
addresses and associated sockets. Not a big problem.
2. Joining a multicast group may be a way to saturate the network.
3. Is it possible to ping the machines that joined a multicast group?
If so, this could be a way to detect all running nessusd.
The big question is: should multicast be restricted to "trusted"
scripts?
security problem IMHO.
The function opens a socket which must not be closed before we want to
leave the multicast group. But we have to close it at the end of the
script to avoid memory leak.
1. Allowing the script to write on the socket is not good, because
a. It breaks the NASL model where the script is supposed to connect
to the "target" only
b. A malicious script could send information out through it.
But with SMTP or NNTP, it is already possible to attack other machines
or leak information out.
=> I implemented a quick and dirty "jamming". A random value is added
to the socket number, so the descriptor cannot be used from the
script. A cleaner way to do it would be to keep an array of multicast
addresses and associated sockets. Not a big problem.
2. Joining a multicast group may be a way to saturate the network.
3. Is it possible to ping the machines that joined a multicast group?
If so, this could be a way to detect all running nessusd.
The big question is: should multicast be restricted to "trusted"
scripts?