Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Ethical Hacker > Mobile Comms and IOT > Flashcards

Mobile Comms and IOT Flashcards

1
Q

Bring Your Own Device (BYOD)

A

Allowing employees to use a personal phone for company business and to store company data on the phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Smartphone attacks

A
  1. Attack the device: Browser attack, phishing, SMS, rooting and jailbreaking
  2. Network attack: DNS cache poisoning, rogue access points, packet sniffing
  3. Data center or cloud attack:
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OWASP Top Ten for Mobile

A 
M1: Improper Platform Usage
M2: Insecure Data Storage
M3: Insecure Communication
M4: Insecure Authentication
M5: Insufficient Cryptography
M6: Insecure Authorization
M7: Client Code Quality
M8: Code Tampering
M9: Reverse Engineering
M10: Extraneous Functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

M1: Improper Platform Usage

A

Android intents,
platform permissions,
misuse of TouchID, the Keychain or other security control that is part of the mobile operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

M2: Insecure Data Storage

A

Insecure data storage and unintended data leakage,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

M3: Insecure Communication

A 
Poor handshaking, 
incorrect SSL versions, 
weak negotiations, 
clear-text communication of sensitive assets, 
insecure communications channels.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

M4: Insecure Authentication

A

Failing to identify the user, failure to maintain user’s identity and weakness in session management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

M5: Insufficient Cryptography

A

Anything and everything related to TLS or SSL but not if cryptography is not employed which is M2. This is attempting to use cryptography just not correctly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

M6: Insecure Authorization

A

Failures to properly authorize a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

M7: Client Code Quality

A

Code level implementations in the mobile client like buffer overflows,
format string vulnerabilities, and
various other code level mistakes where the solution is to rewrite (patch) the code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

M8: Code Tampering

A 
Binary patching, 
local resource modification, 
method hooking, 
method swizzling, and 
dynamic memory modification.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

M9: Reverse Engineering

A

Analysis of binaries to determine its source code, libraries, algorithms, and other assets. Tools like IDA Pro, Hopper, otool are binary inspection tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

M10: Extraneous Functionality

A

Build in a backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Rooting and jailbreaking

A 
Modifying a mobile OS to gain root access to the device. 
Rooting Android tools: 
KingoRoot, 
TunesGo, 
OneClickRoot, 
MTKDroid
Jailbreaking IOS tools: 
evasi0n7, 
GeekSn0w, 
Pangu, 
Redsn0w, 
Absinthe, 
Cydia
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Three Techniques of Jailbreaking IOS

A
  1. Untethered jailbreaking: The kernel will remain patched (jailbroken) after reboot, with or without a system connection
  2. Semi-tethered jailbreaking: a reboot no longer retains the patched kernel but the software resides and can be applied again when needed
  3. Tethered jailbreaking: A reboot removes all jailbreaking patches and the phone may get stuck in a perpetual loop at startup requiring a USB system connection to repair.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Three types of Jailbreaking IOS

A
  1. Userland exploit: Cannot be tethered and can be patched by Apple. Provides user-level access but not Admin. Equates to OS level
  2. iBoot exploit: vulnerability found in the device’s bootloader. iBoot to turn codesign off and run a program. iBoot can be semi-tethered and patched by Apple
  3. BootROM exploit - Allows access to the file system, iBoot, and custom boot logos and is found in the device’s first bootloader, SecureROM. This can be untethered and cannot be patched by Apple. The bootrom exploit is the lowest level and the only way apple can “fix” this is by releasing new hardware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Android Device Administration API

A

Provides system-level device administration to create security-aware apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Mobile Device Management - MDM

A

Can push security policies, applications, and monitor device, passcodes for device unlocking, remote locking, remote wipe, root or jailbreak detection, policy enforcement, inventory and monitoring. Solutions: XenMobile,
IBM MaaS360,
AirWatch,
MobiControl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Bluetooth

A

Open wireless technology for data exchange over short range (10 meters or less). Easy to discover and hack. Has two modes, Discovery Mode and Pairing Mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bluetooth Discovery Mode

A

Determines how the device reacts to inquiries from other devices looking to connect. Has three actions:

  1. Discoverable - respond to all queries
  2. Limited Discoverable - restrict who can query
  3. Nondiscoverable - ignores all queries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Bluetooth Pairing Mode

A

Tells the device how to react when another Bluetooth system asks to pair with it.

  1. Pairable
  2. Nonpairable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Mobile Attacks

A

SMS Phishing
Trojans: Android: Obad, Fakedefender, TRAMPA, ZitMo
Spyware: Mobile Spy, Spyera
Tracking: AndroidLost, FindMyIphone,WheresMyDroid

23
Q

Stagefright

A

Software bugs affecting Android operating systems to perform remote code execution and privilege escalation

24
Q

Mobile Device as an attack platform

A

Network Spoofer

DroidSheep - perform sidejacking by listening to wireless packets and pulling session IDs

25
Q

NetCut

A

You can identify all systems on your current WiFi and cut them off with the click of a button

26
Q

Bluetooth attacks

A
  1. Bluesmacking - denial of service attack
  2. Bluejacking - sending unsolicited messages to and from mobile devices
  3. Bluesniffing - discover bluetooth devices (like war driving)
  4. BlueBugging - successfully access a bluetooth device and remotely use its features
  5. Bluesnarfing - theft of data from a mobile device due to an open connection
  6. Blueprinting - footprinting for Bluetooth
27
Q

Bluetooth attack tools

A 
Bluescanner - locates bluetooth devices
BtBrowser - locate and enumerate 
Bluesniff
btCrawler
Bloover - good for bluebugging
Phonesnoop - spyware
Super Bluetooth Hack - all in one software for hacking bluetooth
28
Q

Internet of Things - wearables

A

Array of smart watches and other items worn by a user that are internet accessible

29
Q

IOT

A

A network of everyday objects with IP addresses that have the capability of sensing, collecting, and sending data to each other made possible by machine to machine communication, large availability of storage and inter networked communication.

30
Q

IOT Components

A
  1. Sensing Technology
  2. IOT Gateways
  3. Cloud
31
Q

IOT Operating Systems

A

Riot OS - embedded systems, actuator boards, sensors, energy efficient and uses minimal resources
ARM mbed OS - low powered wearable devices
RealSense OS X - cameras, Intel’s depth sensing version
Nucleus RTOS - used in Aerospace, medical and industrial applications
Brillo - Android based OS normally found in thermostats
Contiki - made for low powered devices found in street lighting and sound monitoring
Zephyr - low power devices
Ubuntu Core - used in robots, drones - also known as snappy
Integrity OS - found in aerospace, medical, defense, industrial and automotive sectors
Apache Mynewt - devices using Bluetooth Low Energy protocol

32
Q

IOT Communications models

A
  1. Device to Device
  2. Device to Gateway (before sending to cloud)
  3. Device to Cloud
  4. Back-end data sharing
33
Q

Vehicle Ad Hoc Network (VANET)

A

Used by vehicles and the creation of a spontaneous creation of a wireless network for vehicle-to-vehicle (V2V) data exchange

34
Q

IOT Architecture Layers

A

Edge Technology Layer - sensors, RFID tags, readers and devices
Access Gateway Layer - First data handling, message identification and routing
Internet Layer - main component for all communication
Middleware Layer - handles data and device management, data analysis and aggregation
Application Layer - delivery of services and data to the user

35
Q

OWASP - Top ten IOT vulnerabilities and attacks

A

I1: Insecure Web Interface
I2: Insufficient authentication/authorization
I3: Insecure Network Services
I4: Lack of transport encryption/integrity verification
I5: Privacy Concern
I6: Insecure Cloud Interface
I7: Insecure Mobile Interface
I8: Insufficient Security Configurability
I9: Insecure Software/Firmware
I10: Poor Physical Security

36
Q

Attacks against IOT

A 
Distributed Denial of Service (DDOS)
Sybil Attack
Rolling Code attack
Ransomware
Man in the middile
Side Channel
Malware
37
Q

Sybil Attack

A

is an attack wherein a reputation system is subverted by forging identities in peer-to-peer networks.In a Sybil attack, the attacker subverts the reputation system of a peer-to-peer network by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence. A reputation system’s vulnerability to a Sybil attack depends on how cheaply identities can be generated, the degree to which the reputation system accepts inputs from entities that do not have a chain of trust linking them to a trusted entity, and whether the reputation system treats all entities identically. Multiple forged identities are used to create the illusion of traffic congestion that affects everyone else in the local IOT network.

38
Q

Rolling Code attack also called a hopping code

A

The code used by a car key fob is called a rolling code. An attack can sniff for the first part of the code, jam the key fob, and sniff the second part, allowing the attacker to steal the code and the car. Tool: HackRF

39
Q

Blueborne Attack

A

An amalgamation of techniques against known, already existing Bluetooth vulnerabilities

40
Q

IOT Hacking Methodology

A 
Information gathering, 
vulnerability scanning, 
launching attacks, 
gaining access and 
maintaining access
41
Q

IOT Search Engine

A

Shodan

42
Q

Vulnerability scanners and assessment tools for IOT

A 
NMAP
RIoT Vulnerability Scanner
beSTORM
IoTSploit
IoTInspector
Nessus
43
Q

Attacking IOT tools

A 
Firmalyzer
KillerBee
JTAGulator
Attify Zigbee Framework
Telnet
44
Q

IOT Sniffers

A

Foren6
Z-wave
Cloudshark

45
Q

OWASP I1: Insecure Web Interface

A

Account enumeration, lack of account lockout and weak credentials present

46
Q

OWASP I2: Insufficient Authentication/Authorization

A

Weak passwords

47
Q

OWASP I3: Insecure Network Services

A

Susceptible to buffer overflow attacks or create denial of service opportunities

48
Q

OWASP I4: Lack of Transport Encryption/Integrity Verification

A

Allows data to be viewed as it travels over local networks or the Internet

49
Q

OWASP I5: Privacy Concern

A

Collection of personal data without proper protection

50
Q

OWASP I6: Insecure Cloud Interface

A

When easy to guess credentials are used or account enumeration is possible

51
Q

OWASP I7: Insecure Mobile Interface

A

When easy to guess credentials are used or account enumeration is possible

52
Q

OWASP I8: Insufficient Security Configurability

A

When users of the device have limited or no ability to alter its security controls

53
Q

OWASP I9: Insecure Software/Firmware

A

Lack of the ability to be updated

54
Q

OWASP I10: Poor Physical Security

A

When an attacker can disassemble a device to easily access the storage medium

Certified Ethical Hacker (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions