Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCT APP Written > Deck A > Flashcards

Deck A Flashcards

Deck A

1
Q

What is Bluesnarfing

A

A cyber attack involving unauthorised access to information from wireless devices through bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Bluejacking

A

An attack that sends unsolicited messages to Bluetooth-enabled devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is BlueSmacking

A

A Denial of Service attack that overwhelms a device’s Bluetooth connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Bluebugging

A

A technique used to gain control over a device via Bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is BlueBorne

A

A set of vulnerabilities that allow attackers to take control of devices, spread malware, or perform other malicious activities via Bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is KNB

A

KNB is an attack that manipulates the data encryption process during Bluetooth connection estbalishment, weakening security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does KNB stand for

A

Key Negotiation Bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does BIAS stand for

A

Bluetooth Impersonation AttackS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does BIAS do

A

BIAS is an attack that exploits the pairing process allowing an attacker to impersonate a trusted device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Car Whisperer

A

A Bluetooth hack that targets vehicles, attackers can exploit to remotely unlock car doors or even start the engine without physical access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is bluetooth designed for

A

Transferring data over short distances from fixed and mobile devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a network of bluetooth devices called

A

Piconet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are multiple piconets called when they can interact

A

Scatternet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are risks with bluetooth

A

Unauthorised access, data theft, interference and device tracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the legacy Bluejacking attack

A

Sending unsolicited messages to Bluetooth-enabled devices, does not involve stealing data but rather an annoyance. AirDrop suffered from Bluejacking when people had Airdrop settings to Everyone, got fixed with Everyone being disabled after 10 min

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the legacy Bluebugging attack

A

An attacker gains full contol over a Bluetooth-enabled device allowing them to access and modify information, attacker does this by tricking the victim into pairing with a trusted device or brute forcing a pairing PIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is BlueBorn attack

A

Threat presenting hackers the ability to exploit Bluetooth connections and gain complete control over targeted devices from computers mobile TV etc. did not require them to be paired or set on discoverable mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does KNOB or KNB do

A

Exploits a flaw in the Bluetooth standard to undermine the encryption of Bluetooth connections that during pairing the attacker can intercept and set the length of the encryption key to one byte which can be bruteforced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are bluetooth attack mitigations

A

Keep devices updated, disable bluetooth when not needed, don’t connect to random devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Cryptanalysis

A

Cryptanalysis is the process of decrypting coded or encrypted data without access to the key used in the encryption process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Cypher text

A

Cypher text is the scrambled, unreadable form of the plain text resulting from an encryption algorthm, this transformation is controlled by a key which is used in the encryption/decryption process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a Symmetric encryption

A

Same key is used for encryption/decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Asymmetric encryption

A

Public key is used for encryption and private key is used for decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is frequency analysis

A

Based on the statistical study of the letters and symbols in the cypher text, if the freq. of characters in the cypher text matches the freq. of letters in the plain text it can provide clues to the substitution used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a Cryptanalysis Side Channel Attack

A

A Cryptanalysis Side Channel Attack refers to a category of crypographic attacks that exploit information inadvertantly leaked during the execution of cryptographic algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the three types of cryptanalysis sidechannel attacks

A

Timing attacks, Power-monitoring attacks and Acoustic attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a timing attack in cryptanalysis

A

Where an attacker gains information based on the amount of time the system takes to process different inputs. The attack measures the computation time to make informed guesses about the secret key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a mitigation of a timing attack

A

Using constant-time algorithms to remove the correlation between data-dependant computation times and secret information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a power monitoring attack in cryptanalysis

A

An attacker can exploit the variations in a devices power consumption to extract information based on the observation of the power consumption of a device during the execution of cryptographic operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the two different types of Power monitoring attacks

A

Simple Power Analysis (SPA) and Differential Power Analysis (DPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a SPA

A

Simple Power Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a DPA

A

Differential Power Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does a SPA do

A

The attacker interprets the power consumption graph to identify operations, a spike in power could mean a specific operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does a DPA do

A

A more sophisticated attack collecting power consumption data for many operations and using statistical analysis to find correlation between power consumption and values in bits in the secret key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Mitigation of Power monitoring attacks

A

Power regulation and randomisation techniques to make power analysis more difficult

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Acoustic Cryptanalysis attack

A

Where an adversary seeks to extract information by analysing the sound emissions it produces during operation, sound emissions often correlate with different internal states or operations. The sound produced by the computers CPU or fans can change based on the computation being performed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Mitigation of acoustic cryptanalysis attack

A

Use sound-absorbing materials in device construction and phyisically isolating sensitive components to reduce sound emissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the Spectre vulnerabiltiy

A

Spectre is a microprocessor vulnerability which breaks the isolation between applications allowing an attacker to trick error-free programs into leaking secrets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the Meltdown vulnerability

A

Meltdown is a microprocessor vulnerabiltiy that dissolves the isolation between user applications and the operating system allowing a malicious program to access the memory of other programs and the operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the different between BFLA and BOLA

A

In BOLA the user is allowed to use the endpoint, in BFLA they are not authorised to use that endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is BOLA stand for

A

Broken Object Level Authorisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What does BFLA stand for

A

Broken Function Level Authorisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is SSRF

A

SSRF occurs when a web server fetches a remote resource and does not verify if that is an allowed link to the resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How can we determine SSRF

A

Using a netcat connection to ourself or to the localhost:80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How to prevent SSRF

A

Remote resources checked against whitelist, not accepting user-input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is HTTPS also known as

A

HTTP over TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does TLS stand for

A

Transport Layer Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What does SSL stand for

A

Secure Sockets Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the 3 levels encryption can be applied at

A

Encryption at rest - Encryption-in-transit, End-to-end encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is encryption at rest

A

Stored in an encrypted format to prevent unauthorised access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is encryption in transit

A

Data that is transmitted is encrypted before transmission and decrypted after reception

52
Q

What is end to end encryption

A

Encrypts data from the true sender to the final recipient such that no other party can access the data

53
Q

AES DES 3DES Blowfish, RCx are all?

A

Symmetric encryption

54
Q

Name 5 symmetric encryption types

A

AES DES 3DES Blowfish RCx

55
Q

Is the RCx family symmetric or asymmetric

A

Symmetric encryption

56
Q

What are the 4 RCx

A

RC2, RC4, RC5, RC6

57
Q

Name 6 asymmetric encryption types

A

RSA, DSA, ElGamal, ECC, DH, ECDH

58
Q

RSA DSA ECC DH ECDH are all

A

Asymmetric encryption methods

59
Q

What is a Public Key Infrastructure

A

A PKI comprises roles and processes responsible for the management of digital certificates, creation and revocation of certificates

60
Q

What is the purpose of a Certificate

A

The purpose of a Certificate is the bind public keys to an identity this proves the identity of the public key owner, ensuring when we encrypt data using a publi key only the designated recipient will receive it

61
Q

What is a Certificate Authority

A

CA’s are entities that are allowed to issue certificates,

62
Q

How can we verify the identity of a CA

A

Through a CA Certificate

63
Q

Where does the chain of CA’s lead to

A

A root CA

64
Q

What does a cipher suite do

A

A cipher suit defines the cryptographic algorithm used for a connection

65
Q

What is the format of a cipher suite

A

KeyExchangeAlgorithm_ServerAuthentication_WITH_EncryptionWithMode_MACAlgorithm

66
Q

Example of cipher suite

A

TLS_DH_RSA_WITH_AES_128_CBC_SHA256

67
Q

What does PFS stand for

A

Perfect Forward Secrecy

68
Q

What does PFS do

A

Means an attacker is not able to decrypt past messages even after obtaining a session key

69
Q

What cipher suites have PFS

A

All TLS 1.3 and TLS_DHE and TLS_ECDHE have PFS

70
Q

What improvements does TLS 1.3 have over 1.2

A

Dropping support for insecure cryptographic parameters and improving session establishment time

71
Q

What does a TLS 1.3 cipher suite contain

A

EncryptionAlgorithm_Mode_HashFunction

72
Q

What is a block cipher

A

A type of symmetric encryption algorithm that operates by splitting the input into blocks and encrypting the input block by block. It requires the input be divisible by the block size otherwise padding is added

73
Q

What is padding

A

Padding is the extra data added to reach the correct length so that the input is divisibile by the block size if AES block size is 16 and input is 30 we need to add 2 padding bytes to reach 32 bytes

74
Q

What is a padding oracle

A

Padding oracle attacks are the result of verbose leakage of error messages regarding the padding when the CBC encryption mode is used

75
Q

When does a padding oracle exist

A

A padding oracle exists if the system reveals whether the padding is valid or invalid through different error messages responses or timings

76
Q

What does POODLE stand for

A

Padding Oracle on Downgraded Legacy Encryption

77
Q

What does BEAST stand for

A

Browser Exploit Against SSL/TLS

78
Q

Wht are POODLE and BEAST

A

Both are padding oracle attacks that target encrypted data transmitted in SSL 3.0

79
Q

What is the SSL 3.0 padding scheme

A

The last byte is the length of the pad excluding that byte (n-1) and all other padding bytes are arbitrary

80
Q

Example of SSL 3.0 padding

A

DE AD BE EF is 4 bytes and we need 8 bytes so it becomes DE AD BE EF 00 00 00 03

81
Q

What is the essence of the POODLE attack

A

It forced the victim to send a crafted request containing a full block of padding meaning the attacker already knows the last byte then changing the data in the last block

82
Q

Prevention of POODLE

A

Disabling the use of SSL 3.0 entirely

83
Q

What is the Bleichenbacher Attack

A

A type of attack targeting RSA encryption in combination with PKCS#1 padding, if the web server leaks whether the padding was valid or not the attacker can decude informatiomn about the original unmodified plaintext and repeat it

84
Q

Prevention of Bleichenbacher attack

A

Not revealing padding information to the TLS client

85
Q

What is the DROWN attack

A

A type of Bleichenbacher attack that exploits a vulnerability in SSL 2.0

86
Q

What does DROWN stand for

A

Decrypting RSA with Obsolete and Weakened eNcryption

87
Q

Prevention of DROWN

A

Disabling SSL 2.0

88
Q

What does CRIME stand for

A

Compression Ratio Info-Leak Made Easy

89
Q

What does CRIME do

A

It targets the TLS compression and can target cookies for example, the attacker can append a param with the same name as the cookie and an arbitrary value (sess=XXXXX) then observe response length, and replace sequentially (e.g: sess=aXXXX) to see if response length is smaller meaning it was compressed and is a correct character

90
Q

What does BREACH stand for

A

Browser Reconnissance and Exfiltration via Adaptive Compression of Hypertext

91
Q

What does BREACH do

A

A variant of the CRIME attack that targets HTTP-level compression meaning it leaves the HTTP headers uncompressed and we can only attack the HTTP body for things like CSRF tokens

92
Q

What is the Heartbleed Bug

A

The heartbleed extension was implemented to check if a TLS connection is alive with a request in format of (, ) but it was found that the length is not validated and can send a small payload with a large data field and the server will respind with memory beyond the sent payload

93
Q

Prevention of Heartbleed bug

A

Updating from vulnerable OpenSSL version 1.0.1 through 1.0.1f

94
Q

What is SSL Stripping

A

SSL Stripping is forcing a victim to not use HTTPS but fall back to insecure HTTP

95
Q

What is ARP spoofing

A

Sending a forged/spoofed ARP response to become a MiTM and receive packets destined for a different host/MAC

96
Q

What is the mitigation of a SSL stripping attack

A

The header Strict-Transport-Security (HSTS)

97
Q

What does HSTS stand for

A

Header Strict-Transport-Security

98
Q

What does the HSTS do

A

The header tells the browser that the target should only be accessed through HTTPS any attempts to access the site via HTTP are rejected and converted to HTTPS

99
Q

What does Lucky13 exploit

A

A timing difference in the MAC stage when the CBC mode is used. Lucky13 exploits the fact that MAC computation is still slightly longer in some cases

100
Q

What does FREAK stand for

A

Factoring RSA Export Keys

101
Q

What does FREAK exploit

A

Weak encryption used in SSL 3.0 and TLS 1.0 due to US restrictions

102
Q

What are export keys

A

Deliberately weak to comply with regulation in the US that restricted the export of strong cryptographic software

103
Q

What is a Downgrade attack

A

The victim is forced to use a older and insecure version of TLS or cipher suite

104
Q

What is a Cipher Suite rollback

A

It is possible for a MiTM to intercept the ClientHello and alter the list of cipher suite. The ServerHello will then choose a vulnerable cipher suite which the attacker can break

105
Q

What SSL / TLS version does Cipher Suite rollback target

A

SSL 2.0

106
Q

What is a TLS Downgrade attack

A

Where a MiTM can interfere with the TLS handshake and make packets drop resulting in a handshake failure and eventially a downgrade connection from e.g: TLS 1.2 to TLS 1.1 so on so forth down to whatever vulnerable connection

107
Q

What TLS versions should only be offered

A

TLS 1.3 and TLS 1.2

108
Q

When should TLS 1.0 and TLS 1.1 be offered

A

Only if it is necessary to support for legacy reasons

109
Q

What connections are completely insecure

A

SSL 2.0 and SSL 3.0

110
Q

What cipher suites should never be used

A

NULL and EXPORT cipher suites

111
Q

What cipher should should be used

A

Cipher suites that offer PFS (which is all TLS 1.3 and ECDHE and DHE in TLS 1.2)

112
Q

What is SSTI

A

Where web applications that utilise templating engines too dynamically put content on the site can be exploited

113
Q

What does SSTI stand for

A

Server Side Template Injection

114
Q

What does SSI stand for

A

Server Side Include injection

115
Q

What is SSI

A

SSI can be used to generate HTML response dynamically. When SSI directives are not validated an attacker can inject commands into the SSI directives

116
Q

What are the extensions commonly used for SSI

A

.shtml .shtm .stm

117
Q

What is Web Cache Poisoning

A

Web cache poisoning forces a web cache to serve malicious content to unsuspecting users visiting a vulnerable site

118
Q

What is classified as a weak session ID

A

If an attacker can bruteforce it. Needs to be at minimum 16 bytes long

119
Q

What are some session vulnerabilities

A

Premature Session Population, Common Session Variables, Session fixation

120
Q

What is Premature Session Population

A

When information is prematurely uploaded to the session cookie such as a username being stored in the cookie temporarily to provide a customised login failed error message. The cookie is cleared upon seeing the error but hitting the /profile endpoint with that cookie lets you through as the username is in the cookie

121
Q

What is Common Session Variables

A

When there are functionalities that share the same variable such as a 3 step password reset and 3 step account create where the 2nd step in password reset is security question answer. What if we complete step 1 and 2 from account create and use that cookie to bypass step 2 in password reset

122
Q

What is XPath Injection

A

When we can XPath queries do not get sanitised and we can craft specific queries to read contents of an XML document

123
Q

What are some XPath injection methods used for blind exploitation

A

name() substring() and string-length()

124
Q

What is LDAP injection

A

If a LDAP query is not properly sanitised we can perform injection attacks primarily regarding authentication

125
Q

What is LDAP

A

LDAP is a protocol used to access directory servers such as AD

126
Q

What does LDAP stand for

A

Lightweight Directory Access Protocol

127
Q

What is a very basic two examples of LDAP injection

A

On a login form simply * for username and password or a real username and a * for password

CCT APP Written (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions