Add internet detector utility

[emtuls]

This adds a script to detect if internet connection is active or not by adding an icon in the taskbar and also changing the background based on if internet is detected or not.

This will also require an addition of a new python libraries to install:
pywin32

[mr-tz]

How does this script interact with FakeNet? Should FakeNet be handled specifically?

[Ana06]

How does this script interact with FakeNet? Should FakeNet be handled specifically?

If fakenet response is the one we would get with internet, our tool (as other programs like malware) thinks the internet is on. The default fakenet response shouldn't match the ones we are expecting, so without modifying the default fakenet configuration, it will think there is no internet.

@mr-tz do you have a proposal to improve the implementation? What do you exactly mean with handling fakenet specifically?

Note: I think this tool could be hosted in the fakenet repository and even been part of fakenet, it would need to be discussed with the fakenet maintainers to see if it is feasible once we have a working and tested version.

[mr-tz]

I'd expect it to not warn users that the Internet is reachable if FakeNet is running.

[emtuls]

This raises a good thought.

While the tool works with FakeNet active, you would see a lot of requests generated in order for the tool to function promptly. We can potentially reduce the request interval, but this would cause a delay in detecting internet which is a trade-off we need to consider.

What interval would be fair enough to detect a real internet connection in enough time for a user to be aware while also not being too intrusive in a FakeNet output? Also note, due to adding backup internet connectivity URL's, there are now multiple requests that are issued consecutively, rather than a single one.

[emtuls]

I was able to remove the PyQt5 dependency. :)

[emtuls]

Added nicer tooltips that explain what the icons mean: "Internet Detected" vs "Internet Not Detected"

[mr-tz]

I remember some filtering work FakeNet did on Internet connectivity checks to reduce noise. Maybe @tinajohnson can chime in on this?

I'm not sure what a good interval would be, maybe 20 seconds?

[Ana06]

I remember some filtering work FakeNet did on Internet connectivity checks to reduce noise.

We can use the fakenet listener filtering by ensuring the process name has a unique name. We can do this either in fakenet or in the tool package (that should be added to this PR too)

[emtuls]

Chatting with FakeNet team, it sounds like we can add the tool to "Diverter's ProcessBlackList and HTTPListener's ProcessBlackList":
see the second paragraph here ("You may also want to enable..." : https://github.com/mandiant/flare-fakenet-ng?tab=readme-ov-file#anonymous-listener

[emtuls]

I also updated the tool to use a pink icon when internet is active and gray when not, as well as convert everything over to a VM Package and have it install a scheduled task to run every 2 minutes.

It is a .pyw file in order to not have a terminal interface popup for it to run.

[emtuls]

Also note, this will fail to pass the test_upload due to requiring certain files to be existent in the main branch already:
https://github.com/mandiant/VM-Packages/pull/1121/files#diff-bb3df9f8d616b7a9b00f92220dafa6cc20883cdd518f04b8e2c3e3993dfe9fe6R15

[Ana06]

Great work @emtuls 🎉

Just some minor improvement suggestions 😉

• can we change the pink icon to have more contrast with the pink taskbask? (for example with a more intense/lighter pink) it is a bit difficult to see when it is hidden and it does not hurt when it is not:
  
  

• it would be nice that the icon is always visible. It seems I can move it manually to the taskbar and then it stays there. It would be nice if the tool could place it there. I propose you open an issue your this and research if it is possible after this PR has been merged. As it can be placed manually in the taskbar, I do not consider this a blocker and I would like to start using the tool! 🎉

[emtuls]

Great work @emtuls 🎉

Just some minor improvement suggestions 😉

• can we change the pink icon to have more contrast with the pink taskbask? (for example with a more intense/lighter pink) it is a bit difficult to see when it is hidden and it does not hurt when it is not:
  
  
• it would be nice that the icon is always visible. It seems I can move it manually to the taskbar and then it stays there. It would be nice if the tool could place it there. I propose you open an issue your this and research if it is possible after this PR has been merged. As it can be placed manually in the taskbar, I do not consider this a blocker and I would like to start using the tool! 🎉

I have updated it to just use the colored version, which I think looks great with the pink taskbar.

Unfortunately, I don't think there's a way to force the icon to stay on the tray in the taskbar...For me, it starts there, but sometimes gets moved, but it can be moved back down manually. Couldn't find any way to force it to stay on the bottom.

[Ana06]

tool looks good! we need to figure out

[Ana06]

If I have internet in the VM and I start fakenet, I expect the tool to keep showing me there is internet. But this is not the case at the moment (both with and without the config file). Is this the fakenet bug reported in mandiant/flare-fakenet-ng#190?

[Ana06]

If fakenet is reinstalled (to update to a newer version for example) this change will be lost. So I think we should contribute explaining this is a temporary workaround in a TODO comment here and aim to contribute this change to fakenet soon.

[Ana06]

Alternatively (better more robust solution): Move this to our fakenet package in this PR.

We can still open the PR/issue in fakenet afterwards to discuss if porting the change upstream is an option, as otherwise we will have to keep this file in sync in our package which is not ideal.

[Ana06]

Thanks for all the work @emtuls, two minor improvement suggestions, but I think we are good to merge this! 😉

[Ana06]

We are ready to finally get this in and get my pink dynamic analysis VM! 🩷