Analyzing Application & Network Attacks Flashcards

Question

Evil twin

Answer 1

An unauthorized wireless access point - May be added by an employee or an attacker - Potential backdoor Very easy to plug in a wireless AP -or enable wireless sharing in your OS Schedule a periodic survey - Walk around your building/ campus - Use third-paty tool/ Wifi Pineapple

Answer 2

• A less-secure entry point to the network

Answer 3

– A significant wireless denial of service (DoS) attack Wireless disassociation or wireless de-authentication attack is a denial of service attack that is specifically causing devices that are on the wireless network to suddenly not be able to communicate at all to the access point.

Answer 4

• Many different types – Constant, random bits / Constant, legitimate frames • Data sent at random times – Random data and legitimate frames • Reactive jamming – Only when someone else tries to communicate • Needs to be somewhere close – Difficult to be effective from a distance • Time to go fox hunting – You’ll need the right equipment to hunt down the jam – Directional antenna, attenuator

Answer 5

Larger keys are generally more difficult to brute force – The weak IV in RC4 resulted in the WEP security issues

Answer 6

• Wi-Fi Protected Access 3 (WPA3) - Introduced in 2018

Answer 7

Sending of unsolicited messages to another device via Bluetooth – No mobile carrier required! • Typical functional distance is about 10 meters – More or less, depending on antenna and interference • Bluejack with an address book object – Instead of contact name, write a message – “You are Bluejacked!” – “You are Bluejacked! Add to contacts?” • Third-party software may also be used – Blooover, Bluesniff

Answer 8

Access a Bluetooth-enabled device and transfer data – Contact list, calendar, email, pictures, video, etc. • First major security weakness in Bluetooth – Marcel Holtmann in September 2003 and – Adam Laurie in November 2003 – This weakness was patched • Serious security issue – If you know the file, you can download it without authentication

Answer 9

``` It’s everywhere – Access badges – Inventory/Assembly line tracking – Pet/Animal identification – Anything that needs to be tracked • Radar technology – Radio energy transmitted to the tag – RF powers the tag, ID is transmitted back – Bidirectional communication – Some tag formats can be active/powered ```

Answer 10

• Data capture – View communication – Replay attack • Spoof the reader - Write your own data to the tag • Denial of service - Signal jamming • Decrypt communication Wireless jamming • Many different types – Constant, random bits / Constant, legitimate frames • Data sent at random times – Random data and legitimate frames • Reactive jamming – Only when someone else tries to communicate • Needs to be somewhere close – Difficult to be effective from a distance • Time to go fox hunting – You’ll need the right equipment to hunt down the jam – Directional antenna, attenuator Near field communication (NFC) • Two-way wireless communication – Builds on RFID, which is mostly one-way • Payment systems – Many options available • Bootstrap for other wireless – NFC helps with Bluetooth pairing • Access token, identity “card” – Short range with encryption support NFC Security Concern • Remote capture – It’s a wireless network – 10 meters for active devices • Frequency jamming – Denial of service • Relay / Replay attack – On-path attack • Loss of RFC device control – Stolen/lost phone Initialization Vectors (IV) • A type of nonce – Used for randomizing an encryption scheme – The more random the better • Used in encryption ciphers, WEP, and some SSL implementations Salt • A nonce most commonly associated with password randomization – Make the password hash unpredictable • Password storage should always be salted – Each user gets a different salt • If the password database is breached, you can’t correlate any passwords – Even users with the same password have different hashes stored – Many default keys are on Google

Answer 11

``` Two-way wireless communication – Builds on RFID, which is mostly one-way • Payment systems – Many options available • Bootstrap for other wireless – NFC helps with Bluetooth pairing • Access token, identity “card” – Short range with encryption support ```

Answer 12

``` • Remote capture – It’s a wireless network – 10 meters for active devices • Frequency jamming – Denial of service • Relay / Replay attack – On-path attack • Loss of RFC device control – Stolen/lost phone ```

Answer 13

A system with the ability to view the communication between two (or more) hosts (frames, packets) injects itself in the path between the host systems Can be good (Proxy, ALG, Translators) or it can be dangerous (Proxy ARP, DHCP Spoofing)

Answer 14

ARP Poisoning MAC Flooding MMAC Cloning

Answer 15

Address Resolution Protocol - A form of man in the middle attack that exploits ARP - ARP Maps the IP address to the MAC address - When a hacker redirects your traffic to his device and then passes it on to a router, server, switch or other intended devices. - Malicious host injects false frames in order to corrupt (poison) the ARP cache buffers on endpoints, switches, servers, firewalls, and routers - Exploit kits have several scripts, modules, and tools to compromise the ARP protocol - Only works in IPv4 networks - not IPv6

Answer 16

The MAC table is only so big • Attacker starts sending traffic with different source MAC addresses – Force out the legitimate MAC addresses • The table fills up – Switch begins flooding traffic to all interfaces • This effectively turns the switch into a hub – All traffic is transmitted to all interfaces – No interruption in traffic flows • Attacker can easily capture all network traffic! • Flooding can be restricted in the switch’s port security settings

Answer 17

An attacker changes their MAC address to match the MAC address of an existing device – A clone / a spoof • Circumvent filters – Wireless or wired MAC filters – Identify a valid MAC address and copy it • Create a DoS – Disrupt communication to the legitimate MAC • Easily manipulated through software – Usually a device driver option

Answer 18

• Launch an army of computers to bring down a service – Use all the bandwidth or resources - traffic spike • This is why the attackers have botnets – Thousands or millions of computers at your command – At its peak, Zeus botnet infected over 3.6 million PCs – Coordinated attack • Asymmetric threat – The attacker may have fewer resources than the victim

Answer 19

Turn your small attack into a big attackthe attacker performs two malicious tasks. First, the attacker spoofs the IP address of the DNS resolver and replaces it with the victim's IP address. This will cause all DNS replies from the DNS servers to be sent to the victim's servers. Second, the attacker finds an Internet domain that is registered with many DNS records. During the attack, the attacker sends DNS queries that request the entire list of DNS records for that domain. This results in large replies from the DNS servers. Using very few computers, the attacker send a high rate of short DNS queries

Answer 20

This is the generic term from which malware is derived | -A virus is an unwanted and unsolicited malicious program or piece of code that can damage an electronic system

Answer 21

Script viruses are written using script languages This type of virus either infects other scripts or forms a part of multicomponent viruses It affects only those applications for which it has been written