76 lines (59 loc) · 4.3 KB

Security Audit Summary Report: NetScannerMacOS

This report provides a simplified overview of the security vulnerabilities identified during our recent audit of the NetScannerMacOS codebase.

📋 Summary of Findings

Severity	Issue	Status
🔴 High	Unchecked IP Address Parsing	Open
🔴 High	Unsafe JSON Creation	Open
🟡 Medium	Missing Input Validation	Open
🟡 Medium	Potential for Service Disruption (DoS)	Open
🟡 Medium	Unnecessary Security Risk (libpcap)	Open
🔵 Low	Hardcoded Build Paths	Open
🔵 Low	Poor Error Logging	Open
🔵 Low	Lack of Automated Testing	Open

🔴 High-Severity Vulnerabilities

1. Unchecked IP Address Parsing

In Plain English: If the program is given a typo in an IP address, it might accidentally connect to a completely random and unintended device on your network.
Location: src/discovery.cpp (check_port function)
Impact: Could lead to unauthorized access or probing of sensitive local services.
🛠️ Fix: Add a check to ensure the IP address is valid before attempting any connection.

2. Unsafe JSON Creation

In Plain English: Because the program builds its report manually, a clever attacker could "inject" malicious code into the results file to break other tools.
Location: src/scanner.cpp (format_as_json function)
Impact: Malicious data could corrupt scan results or attack software that reads the reports.
🛠️ Fix: Use a standard, reliable JSON library (like nlohmann/json) to handle all report creation automatically.

🟡 Medium-Severity Issues

1. Missing Input Validation

In Plain English: The program doesn't double-check if the numbers provided (like port ranges) are sensible, which could cause the app to crash.
Location: src/scanner.cpp and src/main.cpp
Impact: Maliciously entered data could cause the application to freeze or run indefinitely.
🛠️ Fix: Implement strict rules to ensure all inputs (like ports) are within a valid range (e.g., 1-65535).

2. Potential for Service Disruption (DoS)

In Plain English: The scanner checks one item at a time in a way that could accidentally overwhelm and crash the devices it is scanning.
Location: src/scanner.cpp (scan_subnet and probe_tcp_port)
Impact: Large scans might unintentionally knock devices off the network (Denial of Service).
🛠️ Fix: Update the scanner to work more efficiently in the background and include "speed limits" (rate limiting).

3. Unnecessary Security Risk (libpcap)

In Plain English: The program includes extra tools it doesn't actually use, which gives attackers more "doors" to try and break into.
Location: CMakeLists.txt and src/discovery.cpp
Impact: Increases the "attack surface," making it easier for hackers to gain higher system privileges.
🛠️ Fix: Remove the unused libpcap dependency unless we actually need it for packet capturing.

🔵 Low-Severity Issues

1. Hardcoded Build Paths

In Plain English: The program expects a very specific setup on your Mac, which might cause it to fail when installed on different systems.
Location: CMakeLists.txt
Impact: Makes the software harder to use and install across different environments.
🛠️ Fix: Use standard search paths so the program can find what it needs on any Mac.

2. Poor Error Logging

In Plain English: When something goes wrong behind the scenes, the program doesn't always leave a "paper trail," making it hard to fix bugs.
Location: src/scanner.cpp and src/discovery.cpp
Impact: Troubleshooting network failures becomes much more difficult and time-consuming.
🛠️ Fix: Ensure all important system actions are properly recorded in the error logs.

3. Lack of Automated Testing

In Plain English: There is no automatic "safety net" to catch mistakes when new features are added.
Location: tests/ directory
Impact: Future updates could accidentally break existing security fixes without anyone noticing.
🛠️ Fix: Create a suite of automated tests to verify that all critical parts of the program work correctly every time.