It security part 2 Flashcards
What is the purpose of the cryptographic hash function?
A hash function is a function that records arbitrary long messages to long outputs (n bits)
It stores the data in a hash table
Accelerates password identification
Slows down password identification
A hash function is a function that records arbitrary long messages to long outputs (n bits)
CAs are typically organized in a hierarchy, where the key of a subordinate CA is
attested by another CA at a higher level
True
False
True
Clocks must be synchronized for nonces (unpredictable real numbers)
True
False
False
What is the difference between risk minimisation and risk optimisation?
Risk should be optimized by spending as little as possible on it, i.e. the value of the
minimisation is reduced
They mean the same thing
Minimizing should be supported by all possible resources
Optimisation should be supported by all possible resources
Risk should be optimized by spending as little as possible on it, i.e. the value of the
minimisation is reduced
What does the open design principle say?
Safety through obscurity
Outsiders can have a say in the design, they can make the changes themselves
Software security should not depend on the secrecy of the design
Not only to be used by a closed community
Software security should not depend on the secrecy of the design
How are you protected for long-term storage on iOS?
Keys used for encryption are only saved in iCloud for backup restoration
Data is cryptographically bound to the device
Data is immediately deleted if decryption fails
Data is only accessible after successful fingerprint authentication
Data is cryptographically bound to the device
What type of attack is possible if the key space is small?
brute force
Trojan
malware
any
brute force
Nonces (unpredictable real numbers) do not require an extra message to be sent
True
False
False
What is a certificate chain?
issued certificates are stored in a certificate chain
revoked certificates are stored in a certificate chain
each end-user certificate can be verified by verifying a certificate chain (root to user)
each end-user certificate can be verified by verifying a certificate chain (root to user)
What is a stack frame?
A pair of memory addresses representing the top and bottom of a stack
The programming framework of the stack
When a function is called, the area on the stack that the function handles
The memory area pointed to by the stack pointer
When a function is called, the area on the stack that the function handles
What factors determine the IT security risk? (Multiple answers are fine)
repair
threats
countermeasures
vulnerabilities
threats
countermeasures
vulnerabilities
What is NOT a definition or characteristic of stack overflow?
A special form of buffer overflow
Occurs when a procedure copies user-controlled data into the local buffer stack without
checking the size
User-controlled data overwrites other values in the stack, including the potential return value
The stack indexing is incorrect, resulting in an overflow
The stack indexing is incorrect, resulting in an overflow
Which is NOT one of the hacker groups?
Script Kiddie
Disgruntled employee
Hacktivist group
Terrorist organization
Computer crime organization
State sponsored attacker
Computer scientists
Computer scientists
What do we mean by key space in encryption?
On the backing store, the place where the key can be safely stored
The area indicated by the key pointer
There is no location for the key
The key space of the algorithm is the set of all possible permutations of the key
The key space of the algorithm is the set of all possible permutations of the key
What is stretching?
hash depends not only on the password but also on a random value
hash computation time is accelerated by optimisation
To artificially increase the hash counting time
the password hash can be randomly long
To artificially increase the hash counting time
What is a MAC?
the name of certain apple products
unique identifier
the hash function is located at the address pointed to by the MAC
can be seen as a hash function with an additional input (the key)
can be seen as a hash function with an additional input (the key)
Clocks need to be synchronized for timestamps
True
False
True
Which characteristic does NOT describe the White/Grey box?
Static analysis
Dynamic analysis with specific inputs
Aims to maximize code coverage
Verification where we have only minimal prior knowledge of the system -> only inputs and
outputs are examined, we do not know the inner workings
Generates inputs that trigger new code paths
Much more efficient, but high cost of entry
Verification where we have only minimal prior knowledge of the system -> only inputs and
outputs are examined, we do not know the inner workings
With homomorphic encryption, the cloud service provider can perform certain
operations on the encrypted data and obtain the encrypted result without ever having
access to the data
True
False
True
How does public key binding to an authorized user work?
The public key is assigned to the user by specifying the private key
The user ID and the public key are automatically generated together
The user can choose the public key that suits him
The name and the public key are linked to the digital signature of an authenticated
authenticator
The name and the public key are linked to the digital signature of an authenticated
authenticator
How can we ensure key freshness?
with timestamps, time windows
a nice refreshing cocktail
calendar synchronisation
timers
with timestamps, time windows
The Oracle attack allows an attacker to efficiently decrypt any encrypted CBC
ciphertext message with (adaptively) formatted ciphertexts to the server and observe
its response
True
False
False
What is Stretching?
multiple iterations to slow the exhaustion attack
a random number generated by the system to make the pre-compute attack impractical.
Adds a long random string to the password before…
multiple iterations to slow the exhaustion attack
What is the birthday paradox and how does it relate to the hash function?
choose an arbitrary date as birthday and extend it with a hash function
if you randomly draw elements from a set of N elements, a repeating element has a high
probability of being encountered after sqrt(N) choices
chooses an arbitrary date as a birthday, nothing to do with the hash function
randomly drawing elements from a set of N elements, it can be stated with 100% probability
that it will not meet sqrt(N)
if you randomly draw elements from a set of N elements, a repeating element has a high
probability of being encountered after sqrt(N) choices
Global types of fingerprint patterns: swirl, loop, arc
True
False
True
Proof of cancellation
In some applications, it may be useful if the provider can sort the encrypted data (e.g.: the
user wants to see the results in an orderly way)
When the computation is outsourced, the user can be sure that the service provider has
actually performed the requested task.
Allows keyword searches on encrypted data. The provider cannot learn which words have
been searched or what the statistical properties of the encrypted data are.
When a data is stored in the cloud, the user can be sure that the data still exists
When data is removed from the cloud the user can be sure that all copies of it have been
deleted.
When data is removed from the cloud the user can be sure that all copies of it have been
deleted.
What is the average complexity of an exhaustive key search attack on a k-bit key?
(k-1)
2^(k-1) * 10^10
(k-1)^2
2^(k-1)
2^(k-1)
A countermeasure against side-channel attacks, e.g. to break the link between the
leaked information and the confidential data
True
False
True
What is the hash-and-sign paradigm?
reduces efficiency if you sign the message hash instead of the message
increases efficiency by signing the hash of the message instead of the message
increases efficiency if it duplicates the message hash
reduces efficiency if it duplicates the message hash
increases efficiency by signing the hash of the message instead of the message
What type of information is useful to collect before the attack (there can be several
good answers)
System architecture
Security mechanism used
Access rights
Geological location
System architecture
Security mechanism used
Access rights
The Caesar cipher is easy to crack because a fixed number is the size of the key
space. What is this number?
22
64
67
25
25
The Caesar cipher is easy to crack because a fixed number is the size of the key
space. What is this number?
128
64
256
192
128 256 192
What are the characteristics of a monoalphabetic substitution cipher? (Multiple
answers are allowed)
disadvantage: the frequency of letters depends on the language, not on the content of the
text e.g. in Hungarian the most common letter is “e”
generalization of Caesar cipher
advantage: takes up little storage space
letter substitution is determined by permutation
disadvantage: very easy to crack with the right technical tools
the key is the permutation, which has an area of 26!
disadvantage: the frequency of letters depends on the language, not on the content of the
text e.g. in Hungarian the most common letter is “e”
generalization of Caesar cipher
the key is the permutation, which has an area of 26!
letter substitution is determined by permutation
How many steps does it take to crack a complete system?
Attacks consist of 5 steps
Preparation, execution, cryptographic verification, debugging
Always one big bug causes the compromise of the whole system
Usually a combination of several attacks building on each other and several different
vulnerabilities
Usually a combination of several attacks building on each other and several different
vulnerabilities
What programming error can lead to SQL injection
The system is not connected to the network, so cannot be checked by the application
Data from the client side is processed by the application without verification, malicious code
can be executed on the system
No direct access to the application and the database created from known malware
Non-programming error leads to SQL injection
Data from the client side is processed by the application without verification, malicious code
can be executed on the system
Which risk is not relevant for IT security?
Unauthorised access
Loss of confidentiality or availability of information
attacks against services provided by different systems
technical or hardware damage to the machine during a storm
technical or hardware damage to the machine during a storm
What
What are the steps for fingerprint matching (multiple answers are fine)
matching the two fingerprints according to the most similar minutia pairs
search for parallel similarity between minutiae
Calculating a global similarity score and making a decision
create a minutia correspondence
matching the two fingerprints according to the most similar minutia pairs
search for parallel similarity between minutiae
Calculating a global similarity score and making a decision
create a minutia correspondence
Which of the following is NOT an advantage of cloud computing?
Increases system reliability and user-friendliness
Flexible provision of resources
Increases risk in terms of security, privacy and confidentiality
Reduced price for the user
Efficient for service providers
IT systems easy to deploy, operate and maintain
Increases risk in terms of security, privacy and confidentiality
Which can be an effective defense against ROP?
NX bit
DEP
ASLR random addresses -> cannot predict gadaget addresses
Harvard arch
ASLR random addresses -> cannot predict gadaget addresses
How can we ensure that the established key remains secret?
By encrypting
With RSA
Key exchange protocols
Cannot be kept secret
Key exchange protocols
What are the types of side-channel information?
Timing
network
power consumption
human
power consumption
Timing
Which protocol is used to securely access web pages?
HTTPS
HTTP
GOOGLE CHROME
MOZILLA FIREFOX
HTTPS
