Exercise 3: Why a Leftover Remote Agent Matches Chapter 3's Forgotten Tunnel — Possible Solution ==================================================================== WHAT CHAPTER 3's ORIGINAL WARNING WAS ------------------------------ Chapter 3 warned that "forgetting the tunnel is still open" after diagnostic work is finished leaves an unnecessary, unmonitored access path to a sensitive service open longer than needed - a real security risk created by inaction, not malice. WHAT THIS CHAPTER'S VERSION IS ------------------------------ Per this chapter's finding-box, "leaving unnecessary remote-access software running on someone's machine after a support session ends is a genuine security concern - an unused-but-active remote access path is itself an attack surface, exactly the same category of risk Chapter 3 flagged for a forgotten SSH tunnel, just installed on an end user's own personal machine this time." WHY THE UNDERLYING RISK IS IDENTICAL ------------------------------ In both cases, a legitimate, intentional access path was created for a specific, temporary purpose (diagnosing a database; helping a user). In both cases, that access path continuing to exist after the legitimate purpose is finished creates an avenue someone else could potentially use, entirely unrelated to whether the original access was ever misused. The risk isn't about the original session - it's about what remains reachable afterward, unnoticed and unmonitored. WHY THE CONTEXT DIFFERS BUT THE PRINCIPLE DOESN'T ------------------------------ Chapter 3's tunnel exposed a database service on infrastructure the support engineer administers. This chapter's leftover agent exposes an end user's own personal machine to remote access from whoever might still control that agent. The specific thing being left exposed differs, but the underlying failure - not closing an access path once its legitimate purpose ends - is exactly the same mistake in a different setting. WHY THIS WORKS AS AN ANSWER ------------------------------ It restates both the original Chapter 3 warning and this chapter's own version accurately, and explains specifically why the underlying risk mechanism (an unclosed, unmonitored access path) is the same even though the specific systems involved are completely different.