Module 17 - Hacking Mobile Platforms ( EC Mode ) Flashcards
Which of the following categories of mobile risk covers “Security Decisions via Untrusted Inputs” and is one of the less frequently used categories?
A. Improper platform usage
B. Insecure communication
C. Code tampering
D. Client code quality
Answer: D. Client code quality
Which browser-based attack involves emails or pop-ups that redirect users to fake web pages that mimic trustworthy sites, demanding the users to submit personal information?
A. Man-in-the-Mobile
B. Framing
C. Clickjacking
D. Phishing
Answer: D. Phishing
Which of the following categories of mobile risk covers binary patching, local resource modification, method hooking, method swizzling, and dynamic memory modification?
A. Extraneous functionality
B. Code tampering
C. Client code quality
D. Reverse engineering
Answer: B. Code tampering
Which of the following is not an OWASP Top 10 Mobile Risk?
A. Insecure communication
B. Reverse engineering
C. Buffer overflow
D. Insecure cryptography
Answer: C. Buffer overflow
Which of the following technique helps protect mobile systems and users by limiting the resources the mobile application can access on the mobile platform?
A. Sandbox
B. Spam filter
C. Anti-malware
D. Firewall
Answer: A. Sandbox
Which of the following mobile Bluetooth attacks enables an attacker to gain remote access to the victim’s mobile and use its features without the victim’s knowledge or consent?
A. Bluebugging
B. Bluesmacking
C. Bluesnarfing
D. BlueSniff
Answer: A. Bluebugging
Which of the following is not a mobile platform risk?
A. Malicious Apps in App Store
B. Sandboxing
C. Jailbreaking and Rooting
D. Mobile Malware
Answer: B. Sandboxing
Given below are the various steps involved in an OTP hijacking attack. Identify the correct sequence of steps involved in an OTP hijacking attack.
1.The attacker performs social engineering on the telecom operator.
2.The attacker’s device receives the OTP.
3.The telecom operator transfers the victim’s SIM control.
4.The attacker logs in to the victim’s online accounts via the OTP.
5.The attacker gains the target user’s PII.
Identify the correct sequence of steps involved in an OTP hijacking attack.?
A. 5 → 1 → 3 → 2 → 4
B. 3 → 1 → 2 → 5 → 4
C.1 → 3 → 2 → 4 → 5
D. 4 → 3 → 1 → 5 → 2
Answer: A. 5 → 1 → 3 → 2 → 4
In which of the following attacks does an attacker infect the target device with a remote access Trojan (RAT) and compromise it to access the victim’s camera and microphone?
A. OS command execution
B. Rainbow table attack
C. Camfecting attack
D. GPU-based attack
Answer: C. Camfecting attack
In a type of attack, attackers exploit various bypass vulnerabilities on a target Android device by tricking the victim into downloading a malicious app. When the victim starts using the infected application, a persistent connection is established between the victim and attacker. Identify this attack.
A. Jamming attack
B. Cryptanalysis attack
C. BlueBorne attack
D. Android camera hijack attack
Answer: D. Android camera hijack attack
Which of the following attacks is performed by attackers to eavesdrop on existing network connections between two systems, intrude, and then read or modify data?
A. Packet sniffing
B. DNS poisoning
C. Man-in-the-middle
D. Fake SSL certificates
Answer: C. Man-in-the-middle
In which of the following attacks does an attacker exploit vulnerabilities in the SSL/TLS implementation on websites and invisibly downgrade connections to HTTP without encryption?
A. SSLStrip
B. Packet sniffing
C. Rogue access points
D. Fake SSL certificates
Answer: A. SSLStrip
In which of the following attacks does an attacker bribe or socially engineer telecom providers to obtain ownership of a target user’s SIM?
A. OTP hijacking
B. Camfecting attack
C. Clickjacking
D. Framing
Answer: A. OTP hijacking
Which of the following is an attack technique used by an attacker to gain remote access to a target Bluetooth-enabled device, use its features without the victim’s knowledge or consent, and perform a backdoor attack before returning control to its owner?
A. Bluesnarfing
B. Bluebugging
C. SMiShing
D. Agent Smith attack
Answer: B. Bluebugging
In which of the following attacks does an attacker adopt the trial-and-error approach to guess the valid input to a particular field?
A. Brute-force attack
B. Platform vulnerabilities
C. Cross-site scripting attack
D. Cross-site request forgery attack
Answer: A. Brute-force attack
Which of the following attacks can be performed by spam messages?
A. Bluesnarfing attacks
B. Wardriving attacks
C. Phishing attacks
D. Bluebugging attacks
Answer: C. Phishing attacks
If an attacker is able to access the email contact list, text messages, photos, etc. on your mobile device, then what type of attack did the attacker employ?
A. Bluesnarfing
B. Bluesmacking
C. Bluebugging
D. BlueSniff
Answer: A. Bluesnarfing
When Jason installed a malicious application on his mobile, the application modified the content in other applications on Jason’s mobile phone. What process did the malicious application perform?
A. Data Tampering
B. Data Mining
C. Data Exfiltration
D. Data Loss
Answer: A. Data Tampering
James, an attacker, attempted to gain illegitimate access to a user’s bank account. To achieve his goal, James tricked mobile phone sellers into providing PII of the target user and exploited the instant message service on the user’s device, which helped him reset the password and access the victim’s account. Identify the type of attack performed by James in the above scenario.
A. DNS poisoning
B. Brute-force attack
C. Cross-site request forgery
D. OTP hijacking
Answer: D. OTP hijacking
Which of the following Java API framework blocks manages the data sharing between applications?
A. Activity manager
B. Notification manager
C. Content providers
D. Window manager
Answer: C. Content providers
Which of the following is a native library used in the Android OS architecture and is meant for rendering fonts?
A. Libc
B. Surface Manager
C. Open Max AL
D. FreeType
Answer: D. FreeType
Which of the following countermeasures helps in protecting an Android device from malicious users?
A. Do not directly download Android package (APK) files
B. Disable screen lock for the Android device
C. Install apps that invade privacy
D. Never block ads displayed by apps
Answer: A. Do not directly download Android package (APK) files
Which of the following is an option in Android OS that is used to store private primitive data in key-value pairs?
A. External storage
B. Internal storage
C. SQLite databases
D. Shared preferences
Answer: D. Shared preferences
Which of the following practices is NOT a countermeasure to protect an Android device and the data stored on it from malicious users?
A. Enable the screen pinning option to securely access Android apps
B. Download apps only from official Android markets
C. Enable features such as SmartLock instead of passwords
D. Never root the Android device
Answer: C. Enable features such as SmartLock instead of passwords
