Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security > Exam (by Lersch) > Flashcards

Exam (by Lersch) Flashcards

1
Q

Define passive and active attacks.

A

Passive attacks

  • Eavesdropping: secretly listening to a conversation
  • Traffic Analysis: the inference of information from observation of traffic flows

Active attacks

  • Spoofing (Masquerading): the pretence by an entity to be a different entity
  • Denial of Service (DoS): prevention or inhibition of the normal use or management of communication facilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which are the six Security Services?

A
  • Authentication
  • Access Control
  • Confidentiality
  • Integrity
  • Non-repudiation
  • Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How to attack each security services?

A

Authentication
- IP spoofing, cracking passwords

Access Control
- wire-tapping, breaking authentication

Confidentiality
- eavesdropping, traffic analysis

Integrity
- man-in-the-middle attack, replay attack

Non-repudiation
- deletion of log files, masquerading

Availability
- denial of service attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is jamming?

A

Disrupting the communication by interference on

the same frequency/band. DoS attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an ideal jammer?

A
  • Energy efficient
  • low probability of detection
  • High level of DoS
  • Resistance to anti-jamming techniques
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to measure an ideal jammer?

A 
PSR = packets set / packets intended to be sent
PDR = packets successfully received / packets sent
JSR = (Pj.Bt.Gjr.Grj.Dtr².Ltr) / (Pt.Bj.Gtr.Grt.Djr².Ljr)
CI = |E'| / |V| . (|V|-1)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which are the four jamming strategies?

A
  • Constant jammer: continually emits radio signal
  • Deceptive jammer: continually emits regular packets
  • Random jammer
  • Reactive jammer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to detect a jammer?

A

Using statistics of Statefullnetwork activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How to mitigate a jammer?

A
  • Channel surfing
  • Spatial retreat
  • JSR manipulation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Three broken security mechanisms of IEEE 802.11.

A
  • Hidden SSID (sniff from header of management frames)
  • MAC filtering (sniff allowed MACs and spoof them)
  • WEP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

WEP encryption and decryption.

A

M’ = IV || ((M || CRC(M)) XOR (RC4(IV || key)))
M = RC4(IV || key) XOR ((M || CRC(M)) XOR (RC4(IV || key)))
OBS: demux ICV and M from previous result. Calculate ICV from M and compare for integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Two types of WEP authentication.

A
  • Open System Architecture: AP associates all STA, authentication provided by ability to encrypt messages correctly after association.
  • Shared Key Authentication: challenge-response algorithm.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

WEP weaknesses.

A
  • keys (no key management, length is only 40 bits)
  • encryption (reuse of IV, affects confidentiality & integrity)
  • shared key authentication:
    ciphertext = RC4 XOR (challenge || CRC(challenge))
  • key scheduling (recover secret key, needs IVs and first two octets of encrypted messages)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which are the three categories of GSM channels?

A
  • Traffic Channels (point-to-point between antenna & MS)
  • Common Control Channels (signaling between previous)
  • Dedicated Control Channels ( signaling related to services such and handover procedures or connection establishment)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which are the three attacks on GSM networks?

A
  • IMSI-Catcher (MitM, rogue antenna, turn off encryption)
  • DoS (answer paging req. with channel req. before)
  • Hijacking Services (GSM networks don’t authenticate all services, attacker can redirect to itself, use IMSI-Catcher to turn off encryption).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which are the 4 ways to open your car and start the engine?

A
  • Old-school metallic keys
  • Immobilizers (chips in the key, close proximity, auth.)
  • Active keyless entry (button on key, up to 100m)
  • Passive keyless entry & start (detection of proximity)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How does the PKES security works?

A
  • Authentication: challenge-response protocol

- Proximity inferred from the ability to receive messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are relay attacks on PKES?

A

Messages are relayed from one location to another in order to make one entity appear closer to the other. Does not require breaking cryptography.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Countermeasure for relay attacks on PKES?

A

Distance bounding by measuring propagation delay.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which are the six attacks on WSN?

A
  • Tampering (physical access of nodes, cold boot)
  • Exhaustion & Interrogation (superfluous & expens. op.)
  • Tampered forwarding (modify dev behaviour or rout. tab.)
  • Wormholes (side-channel that provides advantage)
  • Sybil attack (node with multiple ids and arbitrary location)
  • HELLO flooding (broadcast of false neighbor status)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which are the countermeasure for each of the WSN attacks?

A
  • Tampering: camouflage, sensors to detect, use CPU registers or CPU cache, encrypt data in RAM)
  • E&I: auth. requests, rate-limited responses (bases on recent history of request traffic), client puzzles
  • Tampered fwd: disjoint routing paths, node listen channel to make sure neighbor transmited same message, auth. routing updates, periodic end-to-end probing, geo-location for routing, diversity coding)
  • Wormholes: geographic fwd, auth. routing messages
  • Sybil attack: auth. nodes and identities, loc. verification
  • HELLO flooding: bi-directional verification of local links, auth. nodes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is diversity coding?

A

Transmit data over multiple independent paths with redundancy. Split messages in N >= 2 chunks. Compute parity XORing all chunks. M-for-N diversity codes, recover M link failures when M+N links.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How to scan a network?

A
  • ping

- nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How to mitigate scan?

A
  • turn off response to echo protocols

- port knocking (sequence, packet payload, inter-arrival time of packets)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which are the six DoS attacks?

A
  • Ping of Death (old systems, send malformed packet)
  • Teardrop (negative offset of fragmented packets, uint)
  • Ping flood: send many pings to victim
  • Smurf attack: broadcast ping using victim address
  • SYN flood: TCP buffer for half-open connection is limited
  • LAND: send SYN with victim as source and destination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which are the two firewall strategies?

A
  • Blacklisting

- Whitelisting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is Ingress Filtering?

A

Routers know IP ranges of networks connected to each port. Avoid IP spoofing and related attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which are the two approaches for packet filtering?

A
  • Stateless

- Statefull (record outgoing packets, match incoming packets)

29
Q

Which are the five built-in chains in netfilter?

A
  • Prerouting
  • Forward
  • Input
  • Output
  • Postrouting
30
Q

Which are the limits for packet filters?

A
  • Bugs in upper layers
  • Only help against attacks from outside
  • Port-forwarding and tunneling (encrypted, SSH)
31
Q

Which are the three detection types of IDS?

A
  • Signature-based: search intrusion-related signatures
  • Anomaly-based: search changes in network activity
  • Protocol-based: search misbehavior in protocols
32
Q

What characterizes a good IDS?

A
  • Accuracy
  • Performance
  • Fault tolerant
  • Timeliness
33
Q

Where an IDS should be placed?

A
  • Router: for external attacks

- Switches: for internal attacks

34
Q

Which are the limits for IDSs?

A
  • Signature-based only detect known attacks
  • The larger the signature DB, the higher the processing
  • Scans over longer period of time with different sources
  • Fragment packets sent over longer periods of time
  • DoS: flood IDS with possibly invalid fragments
35
Q

Describe the Man-in-the-Middle attack based on ARP.

A

ARP messages are kept in ARP cache of hosts.

  1. Alice broadcasts an ARP request to find Bob.
  2. Attacker respond to Alice saying it is Bob, but giving its own MAC.
  3. Alice updates her ARP cache and send messages to attacker.
  4. Attacker redirects Alice’s and Bob’s messages using ARP spoofing.
36
Q

What are other attacks based on ARP?

A

ARP Cache Overflow: flood host with ARP replies.
ARP Storm: poison the caches with broadcast addresses (bring network performance down).
DoS: update ARP cache for all hosts with non-existing MAC addresses.

37
Q

What are the defenses against ARP poisoning?

A

Switches can use IP-MAC-Port binding, accepting only fixed MAC addresses with fixed IPs at fixed Ethernet ports.

38
Q

How to provide privacy on the internet?

A
  • E2EE: SSL/TLS
39
Q

What do SSL/TLS provides?

A
  • Peer entity authentication
  • User data confidentiality
  • User data integrity
40
Q

Why not use TLS to encrypt all web traffic?

A
  • Slows down web servers
  • Breaks internet caching (can’t cache encrypted sites)
  • Not all information needs encryption
41
Q

What are the steps for TLS Handshake?

A
  1. Client hello
  2. Server hello, certificate, key exchange, certificate request
  3. Certificate, key exchange, certificate verify
  4. Finished
    5.
42
Q

What does a TLS connection state between two parties holds?

A
  • Compression algorithm
  • Encryption algorithm (also the encryption key)
  • MAC algorithm (also the hash key)
43
Q

How does TLS verify a peer entity?

A
  1. Server request to be certified by CA
  2. CA sends server certificate encrypted with private key
  3. Browser has root certificates (pairs)
  4. Client connects to server
  5. Server sends client his certificate
  6. Client use CA public key to verify server certificate
44
Q

Which are the three approaches for key exchange in TLS?

A
  • RSA (mandatory)
  • Diffie-Hellman (server certificate contain DH parameters)
  • Anonymous Diffie-Hellman (vulnerable to MitM attack)
45
Q

Which MAC algorithms are used in TLS?

A
  • MD5 (broken)

- SHA (mandatory)

46
Q

How does a Tor client negotiates a key with each selected onion router?

A
  • Diffie-Hellman
47
Q

Which are the limitations of Tor?

A
  • Analyse traffic patterns and try to correlate
  • Choose of bad entry and exit nodes
  • Introduce special signal into sender traffic to identify it
  • Directory attacks to advertise routes
  • TCP only
  • Cookies can reveal identity
  • Compromised copy of Tor
48
Q

What are Tor directory servers?

A

Multiple and redundant servers that advertise a list of all available onion routers by majority voting.

49
Q

Which security mechanisms does OpenPGP provide?

A
  • Encryption
  • Digital signatures
  • Compression
  • Key management
  • Certificate services
50
Q

How does OpenPGP implements encryption?

A

Each message is encrypted with different key and symmetric cryptography. Key is encrypted with asymmetric cryptography.

51
Q

How does OpenPGP provides authentication, integrity and non-repudiation?

A

With signatures. Sender creates hash sum of message. Sender uses his own private key to encrypt the hash sum.

52
Q

Which is the problem with OpenPGP Signatures?

A

If hash function is not collision-free.

53
Q

Which is the difference between viruses and worms?

A

Virus spread within the system. Worms self-propagate across the Internet.

54
Q

How can we find new worms?

A
  • Network telescope to monitor large range of unused add
  • Honeypots
  • IDS
55
Q

Which are the five roles in a botnet?

A
  • Developer
  • Client
  • Victim
  • Passive participant
  • Botmaster
56
Q

How does the botmaster controls the botnet?

A
  • Command & control messages via a C&C channel
57
Q

Which are the three botnet architectures?

A
  • Centralized (central C&C server)
  • Distributed (bots are client and server simultaneously)
  • Hybrid: distributed clusters of centralized botnets
58
Q

Which is the most critical part of a botnet?

A

C&C channel. Single point of failure in centralized architecture. Channel is encrypted.

59
Q

How can the C&C channel of a botnet be implemented?

A
  • IRC (easy to set up and manage)
  • Web-based (easy to use, scalable, encryption and obfuscation for stealthiness, fault tolerant with multiple servers, easy to sell in the black market)
  • P2P
60
Q

Which attacks can be executed with a botnet?

A
  • DDoS
  • Spamming
  • Data stealing
  • Click fraud
61
Q

Which attacks can be done in the World Wide Web?

A
  • SQL injection
  • Dictionary attacks on hashed passwords
  • Rainbow tables attacks on hashed password (trade-off between memory (less) and processing (more)).
62
Q

How to protect against attacks that use rainbow tables?

A
  • Salted hashes
63
Q

HTTP is stateless. How can a browser implement sessions?

A
  • Hidden values

- Cookies

64
Q

In which ways can an attacker hijack a victim session?

A
  • Sniffing (avoided with E2EE)

- Cross-site scripting

65
Q

Which are the three types of XSS?

A
  • Reflected
  • Persistent
  • Local or DOM-based
66
Q

What is Cross-Site Request Forgery?

A

Attacker trigger HTTP requests via the victim’s browser.

67
Q

How to prevent CSRF?

A
  • Secret validation token (token for each transaction is embed as a hidden value in the webpage and stored in the server. Client has to send it back)
  • Check referer/origin (URL which initiated the request is sent in the header)
68
Q

How to avoid code injection attacks?

A
  • Check user input
  • Escape characters
  • Blacklisting
  • Whitelisting

Security (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions