Module 12 - Evading IDS, Firewalls, and Honeypots

Question 1

IDS, Firewall, and Honeypot Concepts:

Is a security software or hardware device which inspects all inbound and outbound network traffic for suspicious patterns that may indicate a network or system security breach.

a. HIDS (Hardware Intrusion Detection System)
b. SIDS (Software Intrusiton Detection System)
c. IDS (Intrustion Detection System)
d. TIDS (Timed Intrustion Detection System)

Answer 1

c. IDS (Intrusion Detection System)

Question 2

IDS, Firewall, and Honeypot Concepts:

• It detects the intrusion based on the fixed behavioral characteristics of the users and componenets in a comuter system.
• Never seen before.
  a. Protocol Anomaly Detection
  b. Anomaly Detection
  c. Signature Recognition

Answer 2

b. Anomaly Detection

Question 3

IDS, Firewall, and Honeypot Concepts:

• Also known as misuse detection, tries to identify events that indicate an abuse of a system or network resources.
• Known attack
  a. Protocol Anomaly Detection
  b. Anomaly Detection
  c. Signature Recognition

Answer 3

c. Signature Recognition

Question 4

IDS, Firewall, and Honeypot Concepts:

These mechanisms typically consist of a black box that is placed on the network in a promiscuous mode, listening for patterns indicative of an intrusion.

a. Network-Based IDS
b. Host-Based IDS
c. Time-Based IDS
d. User-Based IDS

Answer 4

a. Network-Based IDS

Question 5

IDS, Firewall, and Honeypot Concepts:

These mechanisms usually include auditing for events that occur on a specific host.

a. Network-Based IDS
b. Host-Based IDS
c. Time-Based IDS
d. User-Based IDS

Answer 5

b. Host-Based IDS

Question 6

IDS, Firewall, and Honeypot Concepts:

• Are hardware and/or software designed to prevent unauthorized access to or from a private network.
• They are placed at the junction or gateway between the two networks, which is usually a private network and a public network such as the internet.
• They are the 1st line of defense on a network.

Answer 6

Firewall

Question 7

IDS, Firewall, and Honeypot Concepts:

_____ host is a computer system designed and configured to protect network resources from attack.

• Anything in a DMZ is considered a _____ host.
  a. Multi-homed
  b. Screened
  c. Bastion
  d. Protected

Answer 7

c. Bastion

Question 8

IDS, Firewall and Honeypot Concepts:

• Is a network that serves as a buffer between the internal secure network and insecure internet.
• It can be created using firewall with three or more network interfaces, assigned with specific roles such as internal trusted network, DMZ network, and external un-trusted network.

Answer 8

DMZ (DeMilitarized Zone)

Question 9

Reviwed

IDS, Firewall, and Honeypot Concepts:

• Is either a dedicated stand-alone hardware device or it comes as part of a router.
• The network traffic is filtered using the packet filtering technique.
  a. Packet Filter Firewall
  b. Software Firewall
  c. Hardware Firewall
  d. Circuit Firewall

Answer 9

c. Hardware Firewall

Comments:

-Packet filtering can be done by software (Ex:iptables)

Question 10

IDS, Firewall, and Honeypot Concepts:

• Is a software program installed on a computer, just like normal software.
• It is generally used to filter traffic for individual home users.
• Host-Based
  a. Packet Filter Firewall
  b. Software Firewall
  c. Hardware Firewall
  d. Circuit Firewall

Answer 10

b. Software Firewall

Question 11

IDS, Firewall, Honeypot Concepts:

• Work at the network layer of the OSI model (or the IP later of TCP/IP). They are usually a part of a router.
  a. Packet Filter Firewall
  b. Software Firewall
  c. Hardware Firewall
  d. Circuit Firewall

Answer 11

a. Packet Filter Firewall

Question 12

IDS, Firewall, and Honeypot Concepts:

• Is a private network constructed using public networks, such as the internet.
• It is used for the secure transmission of sensitive information over an untrusted network, using encapsulation and encryption.
• IPSec

Answer 12

VPN (Virtual Private Network)

Question 13

Evading IDS:

Obfuscating means to:

Answer 13

Hide

Question 14

Evading IDS:

What must you do to a packet so the IDS can’t see inside the packet?

Answer 14

Encrypt it

Question 15

Evading IDS:

If you want to get a packet through an IDS you need to?

Answer 15

Fragment it

Question 16

Evading Firewalls:

An attacker has completed the Reconnaissance/Footprinting phase, but did get the information they were looking for. The attacker will then conduct what in order to try and obtain the required information?

Answer 16

Banner Grabbing

Coments:

To identify a Firewall, the atacker can do:

PortScaning -> Some paterns could help to identify the manufacturer.

Firewalking -> Sets TTL to one to identify one holp after firewall and locate it.

Banner Grabbing - > Service banners coul help to identify vendors.

Question 17

Evading Firewalls:

Is used to identify open ports and services running on these ports.

a. Firewalking
b. Port Scanning
c. Banner Grabbing

Answer 17

b. Port Scanning.

Comments:

Firewalking is a technique developed by Mike Schiffman and David Goldsmith that utilizes traceroute techniques and TTL values to analyze IP packet responses in order to determine gateway ACL (Access Control List) filters and map networks. It is an active reconnaissance network security analysis technique that attempts to determine which layer 4 protocols a specific firewall will allow.

Firewalk is a software tool that performs Firewalking.