Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reliance on non-static IDs for third-party abilities triggers Warnings at every startup #2917

Closed
Guil33 opened this issue Mar 14, 2024 · 3 comments · Fixed by mitre/stockpile#574
Assignees
Labels

Comments

@Guil33
Copy link

Guil33 commented Mar 14, 2024

Describe the bug
The adversary ef4d997c-a0d1-4067-9efa-87c58682db71 ("Defense Evasion") includes abilities' IDs that no longer exist or have never existed, which triggers warnings upon booting up the server.

Update (2024-03-28): the IDs not being found is because they are hashes of the abilities taken from the atomic repo, which may change at any time; thus changing the final IDs. A permanent fix needs to remove the reliance on the fact that a hash would be static over time. (see comment below)

To Reproduce

  1. Boot up the Caldera server

Expected behavior
The adversary should include the current and correct IDs.

Screenshots
Warnings at startup:
image
Don't mind the last 2 Warnings with "string" which come from a test I did at some point and forgot about

Undefined abilities in the adversary:
image

Additional context
Although the ids no longer exist, there are very clear replacements for each missing ability (corresponding name and platform).
PR incoming for this.

@Guil33
Copy link
Author

Guil33 commented Mar 28, 2024

Alright, I didn't delve deep enough last time, including with the PR which I closed.

The reason why the abilities IDs changed is because these abilities are taken from the atomic repo, and the IDs are computed from the hash of the abilities: ability_id = hashlib.md5(json.dumps(test).encode()).hexdigest() (atomic_svc.py, _save_ability)

I assume something changed in the atomic repo since the creation of the adversary ef4d997c-a0d1-4067-9efa-87c58682db71, thus changing the ability's hash and thus its final ID.

This means, just updating the IDs in the adversary will be a temporary fix, until the atomic repo changes again and the issue rises once more.
The only permanent fix I can see would be to copy the atomic abilities to the stockpile repo for instance, thus allowing for an actual static ID to work indefinitely.

@Guil33 Guil33 changed the title Obsolete IDs in stockpile adversary triggers Warnings at every startup Reliance on non-static IDs for third-party abilities triggers Warnings at every startup Mar 28, 2024
@elegantmoose
Copy link
Contributor

elegantmoose commented Apr 26, 2024

@Guil33 Might have to be a temporary fix for now unfortunately. Im not keen on keeping another versioned set of ART's abilities.

Happy to merge original PR you had up.

@Guil33
Copy link
Author

Guil33 commented Apr 29, 2024

Yes that's very understandable, unfortunately I couldn't think of a better solution. PR incoming.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
2 participants