6.2 Application Security

Question 1

*
Mobile, embedded, and IoT devices are_____________; security programs should include them.
*

Answer 1

prevalent and vulnerable

Question 2

Compromised devices can lead to consequences ranging from ____________ to ______________

Answer 2

embarrassing to fatal.

Question 3

*
Mobile devices are increasingly vulnerable due to (4)?
*

Answer 3

powerful hardware, constant network connectivity, and movement between environments.

Question 4

__________ _____________ include smartphones, tablets, head-mounted devices, and smartwatches, performing similar functions to non-mobile computers.

Answer 4

Mobile devices

Question 5

*
The line between __________ and ____________has blurred, with some smartphones rivaling computer power and some computers running mobile operating systems.

Answer 5

mobile devices and computers

Question 6

*
Businesses typically use__________ and _____________ to maintain mobile device security.

Answer 6

software and policies

Question 7

*
__________________solutions allow central control of devices, including patching, password changes, and software regulation.

Answer 7

Mobile device management

Question 8

*
Management solutions use agents on devices to _______________________

Answer 8

enforce configurations and can remotely wipe or disable devices.

Question 9

*
Organizations often have __________ policies regulating personal and corporate device use in the workplace.

Answer 9

BYOD

Question 10

*
_________________ are easier to manage centrally, allowing stricter control over apps and security settings.

Answer 10

Corporate-owned devices

Question 11

*
__________ ________________may have limited management capabilities, potentially subverted by savvy users.
*

Answer 11

Personal devices

Question 12

Many organizations allow a mix of personal and corporate-owned devices with varying levels of _______________ and ______________.

Answer 12

access and security features.

Question 13

*
Mobile devices face several specific security issues, including__________________________.

Answer 13

baseband operating system vulnerabilities.

Question 14

*
The baseband operating system handles_______________ and ____________________.
*

Answer 14

hardware functions and is often proprietary and infrequently updated

Question 15

Baseband vulnerabilities can lead to attacks like ___________________________.
*

Answer 15

spying on cell phone communications via SS protocol.

Question 16

_____________ removes manufacturer restrictions, often disabling security features and leaving devices vulnerable.
*

Answer 16

Jailbreaking

Question 17

Jailbreaks typically require
_____________to bypass security, sometimes disabling features or patching files permanently.
*

Answer 17

exploits

Question 18

_____________ patch jailbreak vulnerabilities in new OS versions, leading to a ___________ being developed.
*

Answer 18

Vendors; cycle of new jailbreaks

Question 19

Management solutions and anti-malware apps can help ______________________.

Answer 19

prevent or detect jailbreaking attempts.
*

Question 20

_____________can compromise mobile device security by exploiting granted privileges.

Answer 20

Malicious apps

Question 21

*
Even official app stores aren’t completely safe from malicious apps, as shown by ____________________

Answer 21

cryptocurrency app incidents.
*

Question 22

Jailbroken devices are especially vulnerable to___________________.

Answer 22

malicious apps from unofficial sources.

Question 23

*
To protect against malicious apps, stick to _____________ and avoid _____________.

Answer 23

official app stores; jailbreaking

Question 24

*
Lack of________ ____________for mobile devices and apps can cause major security problems.
*

Answer 24

timely updates

Question 25

Manufacturers often ______________ older devices, leaving them vulnerable to new security threats.
*

Answer 25

stop updating

Question 26

App updates can also be ____________, especially for _____________with less consistent support.

Answer 26

problematic; smaller apps

Question 27

*
Users can mitigate update issues by choosing devices from __________________.

Answer 27

vendors with better update track records.

Question 28

*
Embedded devices are _________________.

Answer 28

computers inside other devices, performing single functions in various applications.

Question 29

*
________________ and ________________systems commonly use embedded devices to control critical infrastructure.

Answer 29

Industrial control systems and SCADA

Question 30

*
Attacks on _________________ can have physical world impacts, as demonstrated by ____________.
.

Answer 30

industrial control systems; Stuxnet

Question 30

*
Many industrial control systems run on proprietary _________ with_______________ similar to mobile baseband systems.

Answer 30

RTOSs; security issues

Question 31

*
_________________ aren’t foolproof protection against attacks on industrial control systems.

Answer 31

Air-gapped networks

Question 32

*
_____________________systems range from vital signs monitors to implanted devices like pacemakers.
*

Answer 32

Medical devices with embedded

Question 33

Security vulnerabilities in medical devices can have life-threatening consequences, as shown by the ___________ _______________issue.

Answer 33

Medtronic pacemaker

Question 34

*___________ can have up to 70 embedded devices communicating over a ___________ to control various functions.
*

Answer 34

Cars ; CAN bus

Question 35

_________ ____________ has demonstrated the potential for remote control of vehicle functions, posing serious safety risks.

Answer 35

Car hacking

Question 36

*
_____________ embedded devices can be challenging or impossible, especially for_________ _________devices.

Answer 36

Upgrading; implanted medical

Question 37

*
The hardware in embedded devices is typically expected to __________________ of the containing device.

Answer 37

last the lifetime

Question 38

*
Compromised embedded devices can have huge ____________ and critical _____________.

Answer 38

physical impacts on human safety - infrastructure

Question 39

*
_________________ may target embedded devices controlling essential systems like power and water.
*

Answer 39

Nation-state attacks

Question 40

Vendors and _____________ are increasing attention to embedded device security, with more training available.
*

Answer 40

governments

Question 41

________ devices are becoming more prevalent in everyday appliances, bringing new security challenges.
*

Answer 41

IoT

Question 42

The term “Internet of Things” was coined in ____ and now refers to any _____________________without a ____________.

Answer 42

1999; internet-connected device ; full desktop OS

Question 43

*
Network printers are common _____________with complex operating systems and potential security vulnerabilities.
*

Answer 43

IoT devices

Question 44

Networked surveillance cameras are often vulnerable due to simple________________ or __________________.
*

Answer 44

default credentials or backdoors.

Question 45

Smart locks and other physical security IoT devices can have serious vulnerabilities, as demonstrated by the _____________________ issue.

Answer 45

Tapplock (smart padlock) issues.

Question 46

*
The line between embedded and IoT devices is fuzzy, with some key differences in ____________ and ____________.
*

Answer 46

design and connectivity.

Question 47

IoT devices often lack ________________ in their operations, making it difficult to detect ___________________.
*

Answer 47

transparency; unusual behavior

Question 48

The proliferation of IoT devices has led to large-scale attacks, such as the_______________attack.
*

Answer 48

Mirai botnet DDoS

Question 49

_____________ IoT devices pose ongoing security risks, as many older devices remain in use without _________.
*

Answer 49

Outdated - updates

Question 50

Updating older IoT devices can be challenging, especially for ________________ users

Answer 50

non-technical

Question 51

Describe Bounds checking -

Answer 51

When you don’t properly account for the size of data input into your application

Question 52

What does a fuzzing tool do?

Answer 52

a technique to bombard an application with data and input from all sources to get it to fail or act strangely.

Question 53

Give an example of a race condition.

Answer 53

Saving a document in the cloud at the same time another person does; which document truly saves the latest version.
Occurs when multiple threads within a process control access to a particular resource and the correct handling depends on timing or transactions.

Question 54

Why is it important to remove extraneous files from a web server?

Answer 54

attackers could use against your system, ie..source code

Question 55

What does the tool Burp Suite do and in what situation might you use it?

Answer 55

Web analysis too; discover, exploit, and mitigate security vulnerabilities. When you need to scan a web application for security vulnerabilities, Burp Scanner can automate this process

Question 56

Name the two main categories of web security.

Answer 56

Client Side and Server Side

Question 57

Is a SQL injection attack an attack on the database or an attack on the web application?

Answer 57

Database attack

Question 58

Why is input validation important?

Answer 58

Could leave you open to a format string attack if user input isn’t in correct format.

Question 59

Explain a cross-site request forgery attack and what you might do to prevent it.

Answer 59

Log out of websites and close those windows when finished.

Question 60

How might you use a sniffer to increase the security of your applications

Answer 60

You can watch specific network traffic that is being exchanged.

Question 61

How can you prevent buffer overflows in your applications?

Answer 61

Use bounds checking to limit the amount of data you take in

Question 62

What is cross site scripting (XSS)? Is it client side or server side attack?

Answer 62

Attacks inserts code in a scripting language into a page or other media like adobe -; displayed by the client browser. Client side attack.

Question 63

What is a directory transversal attack? Is it client side or server side attack?

Answer 63

When you don’t validate input into web applications - Server Side Attack

Question 64

Is clickjacking client side or server side attack?

Answer 64

client side

Question 65

A ______________ occurs when multiple threads within a process control access to a particular resource and the correct handling depends on timing or transactions.

Answer 65

race condition

Question 66

______________________is a data-network packet analyzer computer program that runs under a command line interface. It is not a type of tool categorized as an exploit framework.

Answer 66

TCPdump

Question 67

_______________is a centralized penetration testing tool that enables security teams to conduct advanced, multi-phased penetration tests. It is a type of tool categorized as an exploit framework. Exploit frameworks include pre-packaged sets of exploits.

Answer 67

Core Impact