Ch 14, 15, 17, 18 Flashcards
Your log shows that the Notepad process on a workstation running as the local administrator
account has started an unknown process on an application server running as the SYSTEM account.
What type of attack(s) are represented in this intrusion event?
The Notepad process has been compromised, possibly using buffer overflow or a DLL/process injection attack.
The threat actor has then performed lateral movement and privilege escalation, gaining higher privileges through remote code execution on the application server.
You are providing security advice and training to a customer’s technical team. One asks how they can identify when a buffer overflow occurs.
Real time detection of a buffer overflow is difficult, and is typically only achieved by security monitoring software (antivirus, endpoint detection and response, or user and entity behavior analytics) or by observing the host closely within a sandbox. An unsuccessful attempt is likely to cause the process to crash with an error message.
If the attempt is successful, the process is likely to show anomalous behavior, such as starting another process,
opening network connections or writing to AutoRun keys in the registry. These indicators can be recorded using
logging and system monitoring tools.
What is the effect of a memory leak?
A process claims memory locations but never releases them, reducing the amount of memory available to other processes. This will damage performance, could prevent other processes from starting, and if left unchecked could crash the OS.
How can DLL injection be exploited to hide the presence of malware?
Various OS system functions allow one process to manipulate another and force it to load a dynamic link library (DLL). This means that the malware code can be migrated from one process to another, evading detection.
Other than endpoint protection software, what resource can provide indicators of pass the hash attacks?
These attacks are revealed by use of certain modes of NTLM authentication within the security (audit) log of the source and target hosts. These indicators can be prone to false positives, however, as many services use NTLM authentication legitimately
You are reviewing access logs on a web server and notice repeated requests for URLs containing the
strings %3C and %3E. Is this an event that should be investigated further, and why?
Those strings represent percent encoding for HTML tag delimiters (< and >). This could be an XSS attempt to inject a script so should be investigated.
You have been asked to monitor baseline API usage so that a rate limiter value can be set. What is
the purpose of this?
A rate limiter will mitigate denial of service (DoS) attacks on the API, where a malicious entity generates millions of spurious requests to block legitimate ones. You need to establish a baseline to ensure continued availability for legitimate users by setting the rate limit at an appropriate level.
How does a replay attack work in the context of session hijacking?
The attacker captures some data, such as a cookie, used to log on or start a session legitimately. The attacker then resends the captured data to re-enable the connection.
How does a clickjacking attack work?
The attacker inserts an invisible layer into a trusted web page that can intercept or redirect input without the user realizing.
Tricks a user into clicking a webpage element which is invisible or disguised as another element
What is a persistent (stored) XSS attack?
Where the attacker inserts malicious code into the back-end (server-side) database used to serve content to the trusted site.
The injected script is stored permanently on the target servers. The victim then retrieves this malicious script from the server when the browser sends a request for data.
How might an attacker exploit a web application to perform a shell injection attack (aka OS command injection)?
The attacker needs to find a vulnerable input method, such as a form control or URL or script parser, that will
allow the execution of OS shell commands.
You are improving back-end database security to ensure that requests deriving from front-end web servers are authenticated. What general class of attack is this designed to mitigate?
Server-side request forgery (SSRF) causes a public server to make an arbitrary request to a back-end server. This is made much harder if the threat actor has to defeat an authentication or authorization mechanism between the web server and the database server.
What type of programming practice defends against injection-style attacks, such as inserting SQL commands into a database application from a site search form?
Input validation provides some mitigation against this type of input being passed to an application via a user form.
Output encoding could provide another layer of protection by checking that the query that the script passes to the database is safe.
(replacing HTML control characters (e.g. , “, &, etc) into their encoded representatives)
What coding practice provides specific mitigation against XSS?
Output encoding ensures that strings are made safe for the context they are being passed to, such as when a JavaScript variable provides output to render as HTML. Safe means that the string does not contain unauthorized syntax elements, such as script tags.
You are discussing execution and validation security for DOM scripting with the web team. A junior team member wants to know if this relates to client-side or server-side code. What is your response?
The document object model (DOM) is the means by which a script (JavaScript) can change the way a page is rendered. As this change is rendered by the browser, it is client-side code.
Which response header provides protection against SSL (downgrade) stripping attacks?
HTTP Strict Transport Security (HSTS).
What vulnerabilities might default error messages reveal?
A default error message might reveal platform information and the workings of the code to an attacker.
What is an SDK and how does it affect secure development?
A software development kit (SDK) contains tools and code examples released by a vendor to make developing applications within a particular environment (framework, programming language, OS, and so on) easier. Any element in the SDK could contain vulnerabilities that could then be transferred to the developer’s code or application.
What type of dynamic testing tool would you use to check input validation on a web form?
A fuzzer can be used to submit known unsafe strings and randomized input to test whether they are made safe by input validation or not.
Which tools can you use to restrict the use of PowerShell on Windows 10 clients?
There are various group policy-based mechanisms, but for Windows 10, the Windows Defender Application Control (WDAC) framework provides the most powerful toolset for execution control policies.
