Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information security > Network security: Introduction to network security > Flashcards

Network security: Introduction to network security Flashcards

1
Q

How does TCP/IP work

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How does routers work?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does ARP work?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How is risk managed?

A
  • Accepting the risk: watch for it (monitoring), not mitigating
  • Transfer the risk (insurance, taking the risk and transfering the impact somewhere else)
  • Remove the risk
  • Mitigate the risk: Reduce impact, reduce the risk itself
  • Policies and mechanisms implementation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is risk assessment?

A

Calculating impact of risk

Quantitative risk assessment: Monetary value for impact
Qualitative risk assessment: Categorize the levels of risk (Low, medium, high)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are threat trees?

A

Root node is the threat
The child-nodes are sub-threats
Relationships between sibling nodes can be AND or OR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a threat matrix?

A

Tool that model and categorizes potential threats by applying a structured ranking process (low-severe)

Categories:
- Existence
- Capability
- History
- Intentions
- Targeting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How does boolean values move in an attack tree

A

Parent node inherit value of children

AND children: I + P -> I
OR children: I + P -> P

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How does continuous values move in an attack tree

A

Most likely attack is the cheapest one that requires no special equipment

Values propagate upwards
OR: Parent get the cheapest child value
AND: Parent get sum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define Exposure Factor (EF)

A

Percentage of asset loss caused by identified threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Single Loss Expectancy (SLE)

A

Asset value times EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Annual Rate Occurrence (ARO)

A

Estimated frequency of a threat during a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Annual Loss Expectancy (ALE)

A

SLE * ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the steps in theNetwork attack methodology?

A

Initial recon
Initial compromise
Establish foothold
[ -> loops
Escalate privileges
Internal recon
Move laterally
Maintain presence ->
] -> complete mission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is reconnaissance?

A

Attackers are likely to spend a lot of time on this step

Non technical: Dumpster diving, going through someone’s personal belongings, social media

Technical: Trying to identify the target’s OS, technical training, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What happens during the vulnerability identification phase of a network attack?

A

Identifying resources that are being exposed (IP address, software, OS, exposed ports)

Can there be any vulnerabilities in software, design mistake, misconfiguration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What happens during the exploitation phase of an network attack

A

The attacker is gaining access, preferably root level- or admin access.

Getting control of a user - elevating that user’s privileges

Denial of service (DoS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What happens during post exploitation of an network attack?

A

This is the goal of the attack
Accessing and retrieving data.
Maintain long term access
Removing forensic information on the systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is reconnaissance?

A

First step in a system attack.

Gathering information about the target before doing the attack itself.

Want to spend quite a bit of time in this step gathering information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What information can be gathered during the reconnaissance step of a network attack?

A
  • IP Addresses: Range of IP addresses used by the target
  • Network topology information: Gathered through experimentation or probing the network.
  • Domain names
  • Account logins : What format of account login is used. Is account names inferred by email addresses, are they first + surname
  • Operating systems and software: Look at job listings to see if they mention software
  • Security policies: Password complexity policies, reset password procedures, can a user call up and have their password reset later in the attack
  • Physical security systems: Can a goal be accomplished by visiting the target in person?
  • Employee hangouts: Overhear conversation, look at mobile phones and laptops, ID badges

Low tech (dumpster diving - look for documents, physical break in, social engineering - take advantage of people’s emotions to get them to reveal information)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the Google Hacking Database?

A

Indexes advanced searches that target information people have left online. Can be used to find specific information about your target. This, in addition to using Google advanced search correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Cree.py?

A

Open source intelligence gathering application that can gather pictures from social network platforms and sort geolocation data from the pictures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What can an attacker use DNS for?

A

Domain registrants need to provide name, address and phone number for the admin and technical contact of their domain.

If an attacker has the IP Address of the DNS server, they can gather more information about the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the different types of DNS records? (10)

A

A, MX, NS, CNAME, SOA
SRV, RP, PTR, TXT, HINFO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an A record (DNS)?

A

Address record describing the IP address of a node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is an MX record (DNS)?

A

Mail exchange
IP address of the server which handles mail for the domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a NS record (DNS)?

A

Name server.
The domain name server that serve this domain name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a CNAME record (DNS)?

A

Canonical name
Aliases for host names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a SOA record (DNS)?

A

First line of DNS file.
Indicates that this server is the best source of information for this domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a SRV record (DNS)?

A

Service record.
Information about available service in the domain
SIP ans XMPP use this

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a RP record (DNS)?

A

Responsible person.
Assign an email address to a specific host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a PTR record (DNS)?

A

Pointer record.
Allows for reverse DNS lookup.
Typically required for MX hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is a TXT record (DNS)?

A

Originally for human readable information, but now used for things such as domain keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is a HINFO record (DNS)?

A

Host info.
Supplies OS and other info about a host.
Generally not a good idea to have this record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What can WHOIS be used for?

A

To lookup who owns a website or domain name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Robtex and what is it used for?

A

Is a free DNS lookup tool

It is used for research of IP numbers, domain names, etc.

Robtex gathers public information about IP numbers, domain names, host names, autonomous systems, routes, etc.
Robtex then indexes the data in a database

37
Q

What is the Border Gateway Protocol (BGP)

A

The routing protocol that ties different autonomous systems together across the internet.

It’s common for internet service providers to leave a “looking glass” server open for anyone to access. We can then run our own trace routes, take a look at routing tables and gather information about how the target is connected to the internet.

38
Q

What is “Looking glass” servers?

A

A router with view-only access and no password protection

39
Q

What does traceroute do?

A

Uses ICMP packets to record the route from one computer to another through the internet.

40
Q

What is ICMP?

A

A network level protocol that communicates info about network connectivity issues back to the source of the compromised transmission.
It is connectionless, as it is not associated with transparent layer protocols such as TCP and UDP, meaning a device does not need to open a connection with another to send a packet.

Example of usage: Tracerout, ping

41
Q

What is SHODAN?

A

A search engine that indexes meta data that is found on devices connected to the internet.
Can search if any devices inside an organisation is running this and this software version.

E.g. a router: SHODAN will find out what version of software the router is running, what kind of router

Web server: Type of OS, type of web server, software version

42
Q

How can you identify available hosts within a given IP address space?

A

Do a ping sweep and see what is answered back.
The ping sweep is a network scanning technique used to find out which IP addresses map to live hosts.
Uses ICMP ECHO requests to communicate with multiple hosts at the same time.

Tool: Angry IP scanner

43
Q

What can you do if ping sweeps doesn’t work, and what is then the cause of them not working?

A

If a host-based firewall is configured to ignore ICMP packets, ping sweeps won’t work.

Instead we can leverage domain name systems (DNS).
DNS zone transfers regularly synchronize the primary and the backup DNS servers so that the backup periodically receives a copy of the primary server’s DNS database.
If this synch process is configured incorrectly, an attacker can pretend to be the backup DNS server, and then receive this data.

44
Q

What is “dig” and what is it used for?

A

dig-information-grouper is a linux tool designet to interrogate domain name servers.

Syntax:
dig @<DNS_SERVER_IP> <target_domain> -t AXFR</target_domain></DNS_SERVER_IP>

dig can be used by an attacker to pretend to be a backup dns server, perform a zone transfer, and receive data entries from the target DNS database

45
Q

What can be done if zone transfer isn’t possible?

A

Brute force attack
List potential host entries into a text file and throw them at the DNS server one by one.

If the DNS server responds with an IP address for one of the potential hosts, we know there are an entry in the DNS server’s database

46
Q

What is Split DNS?

A

A technique used to prevent internal information from the DNS database to be leaked.

Have two DNS servers. For machines that are designed to be available on the internet (email-server, web-server), place these entries in an external DNS server.

Internal employees uses an internal DNS server

47
Q

What is port scanning

A

Port scanning measures whether open TCP ports are open and listening by sending TCP and UDP packets to various ports and determine if a process is active on those ports.

48
Q

What is the connect scan/SYN scan?

A

A type of port scan that is based on the TCP three way handshake.
If you get this full handshake you can be sure that the port is open.

Send SYN to server, receive SYN/ACK and send back ACK - have now verified the port is open. (TCP Connect Scan)

If you don’t send back the ACK flag we may prevent the scan from being logged. Could also send a TSR to tear down the connection once the SYN/ACK is received to achieve the same thing. (TCP SYN Scan)

If the server sends back RST/ACK, it means the port is closed.

If no packages is received back from the initial SYN, there might also be a firewall filtering away the package.

49
Q

What is the TCP three way handshake?

A

The source machine first sends a SYN flag to the destination.
The destination answers with a SYN flag and an ACK flag
The source then answers with an ACK flag

50
Q

What is firewalk?

A

Tool used to determine if targets are available behind a firewall.
When an IP packet expires the machine router will reply back with ICMP “time exceeded” to the source. If we receive this outside the firewall, we can determine that the firewall is allowing traffic though

51
Q

What is HTTPRecon

A

Tool that look at a web server and captures the response headers that are coming back.
This will show information about the server being run.

52
Q

What is Vega?

A

An open source tool that scans application running on the web server and provides information about the server, type, what it’s running on and if there is any vulnerabilities precent on the web application.

53
Q

What is Vega-scanner?

A

Scans websites recursively, building a representation of the site in a tree-like datastructure comprised of entities known as “path state nodes”. These can be files, directories, files with GET or POST parameters, etc.

54
Q

How can attackers stay anonymous?

A

Using a proxy server.
An TCP connection from your machine would terminate at the proxy server. The proxy server would then reoriginate the TCP connection to the Web server and carry HTTP from the proxy to the web server.
The web server will only see the connections coming from the proxy

55
Q

What is IP spoofing, and why is it used?

A

IP spoofing is when someone changes the source IP address in a packet, so that the packet seems to come rom another machine on the network.
When changing the source IP, the attacker themselves won’t receive back a response packet from the recipient, this response goes to the IP address the attacker changed the source to.

This is done by attackers to avoid linking their actions back to them.

56
Q

Is IP spoofing possible with TCP?

A

In general, no. This is because the attacker won’t receive back the SYN/ACK flag, which would complete the connection.

There are, however, some exceptions. If the attacker is able to achieve a man-in-the-middle, they could be able to achieve IP spoofing

57
Q

What is ingress filtering?

A

A way to protect against IP spoofing.
This is where an organisation puts up a firewall that detects if any packages from the internal network has a source IP that is not in the organisation’s address space. The firewall would then know that a machine in an organisation’s network has spoofed their IP address and drops the packet.

The firewall can also have been put up by the internet service provider that would check if a packet from a client has a source IP that falls within the client’s address space.

58
Q

What is BGP filtering?

A

BGP is a routing protocol to route between autonomous systems (often internet service providers).

In BGP there is a hierarchical structure where for example a Tier 1 ISP serves Regional ISPs, and the Regional ISPs serves clients.
Each ISP will advertise what IP address-spaces they

59
Q

What is BGP filtering?

A

BGP is a routing protocol to route between autonomous systems (often internet service providers).

In BGP there is a hierarchical structure where for example a Tier 1 ISP serves Regional ISPs, and the Regional ISPs serves clients.
Each ISP will advertise what the IP address-spaces of the clients they serve are.
By doing this, the Tier 1 ISP can filter away all the packets from IP addresses that aren’t in the address spaces that the connected regional ISPs are advertising.

60
Q

What is a problem with BGP filtering happening at the Tier 1 ISP that serves regional ISPs each with multiple clients?

A

As the Tier 1 ISP allows IP addresses from all the regional ISPs clients, an attacker from lets say the 12.12/24 network can spoof their IP address to an address in one of the other clients address spaces, of the same Regional ISP, 34.34.1.1. This is possible because the Tier 1 ISP serving the regional ISP allows both 12.12./24 and 34.34/24.
Meaning, neighbouring networks can still spoof one another.

61
Q

How can an attacker achieve session hijacking?

A

By utilising spoofing and sniffing techniques to take control of one side of a TCP connection.

62
Q

What is Denial of Service (DoS) ?

A

Preventing a legitimate user from accessing resources and functionality that should be available to them.

63
Q

What is DoS attacks?

A

An application layer attack where an attacker sends a multitude of crafted packets from one single spoofed IP in order to crash an application that is connected to the internet.

DoS can happen if an attacker sends a special packet that crashes the server, or sends a large volume of packets that overflows the servers capacity.

64
Q

What is a DDoS attack?

A

In a Distributed Denial of Service attack, an attacker will organise thousand of compromised machines in a botnet so that the flooding traffic originates from multiple IP sources that are not spoofed. The machines aren’t spoofed because there is too many to effectively deny the IP packets.

65
Q

What is a Land attack?

A

A LAN sends a spoofed packet with the source and destination IP address port being the same. If a windows machine receives this, it will cause the machine to bluescreen.

66
Q

What is a ping of death attack?

A

An attacker send an over-sized ping packet in order to crash the receiving machine.

67
Q

What is a Jolt2 attack?

A

The attacker sends a stream of fragments, non of them having offset 0. Rebuilding will consume all of the processors capacity.

68
Q

What is a Teardrop, Newtear, Bonk and Syndrop?

A

They are all tools that send overlapping fragmented packets to crash the target machine.

68
Q

What is a Teardrop, Newtear, Bonk and Syndrop?

A

They are all tools that send overlapping fragmented packets to crash the target machine.

69
Q

What s a SYN flood attack?

A

An attacker spoofs their IP and sends a multitude of SYN packets, not letting the server respond in between. The server will then use up all its memory to track the half open connections, and will then crash.

70
Q

How can you defend against SYN floods?

A

We can protect by using SYN cookies.
When a server receives a SYN packet, the server calculates a hash based on the source and destination IP, and a randomly generated number.
The server then uses this hash as its initial sequence number in the SYN/ACK response.
Because of this, the server doesn’t have to allocate any memory to keep track of the connection.

If the source is legitimate, the server receives an ACK flag and computes the same hash to verify the source, before the TCP connection is opened.

If the server doesn’t receive back an ACK, there is no problem as the server doesn’t track the original SYN

71
Q

What is a reflection attack?

A

Uses the same topology as a DDoS attack by using numerous resources like bots or compromised web servers.
The attacker will look for a UDP protocol on the internet that sends a small amount of traffic to a source, and receives a large amount of traffic back.
E.G. a DNS lookup where we search for one host, but get a potentially large list back from the DNS server of areas whre the resource is located.

72
Q

What is an amplification attack?

A

Amplification attacks are attacks that amplify the traffic.
The attacker can also spoof their IP address to be the victims, so that the victim is the one receiving the traffic.

73
Q

Describe a DNS amplification attack.

A

A reflection based, volumetric, DDoS attack.
The attacker leverages the functionality of open DNS resolvers in order to overwhelm the target with amplified traffic.

74
Q

What is an NTP amplification attack?

A

A reflection based, volumetric, DDoS attack.
Attacker exploits Network Time Protocol (NTP) server functionality to overwhelm the target with UDP traffic.

75
Q

What is a memcached DDoS attack?

A

Attacker spoofs requests to a vulnerable UDP memcached server, which then floods a target with internet traffic.
While the target’s internet infrastructure is overloaded, other requests won’t be able to access resources resulting in DoS.

76
Q

How can you defend against DDoS?

A
  • Don’t let your systems become bots
  • Filter bad packets: If you can identify which packets are trying to overwhelm a system, try filtering these out
  • Build more resources than the attacker: An attacker will have limited bandwith and computing power, if you have more - this can protect against an attack
  • Create a distributed infrastructure: Distribute a resource that is likely to be targeted, so that there is no single point that can be overwhelmed.
77
Q

What is DNS poisoning?

A

When an attacker modifies the IP address in a DNS cache entry to point to their own resource. Can be used during phishing attacks.

Name servers do not however accept unsolicited replies where a record is simply inserted into a name server by sending a DNS reply message.
This is because name servers us IDs in DNS messages to match reply queries.

Attackers can send a reply to a request with a spoofed IP address. To achieve this, they need to guess the request’s sequence number and prevent the authorative name server to answer.

78
Q

What is reverse shell attacks?

A

An attacker can send a file or a link to a victim who then clicks on it. An example is when a link make the victim download software that compromises one of the applications on the target machine. Once this exploit is sent, the payload is delivered and a reverse shell is initiated from the victim and to the attacker.

As the target is behind a firewall, an attacker can’t directly connect to them. However, as firewalls allows connections from inside and to outside the connection can be made. In this case the target will connect to a pre-configured IP Address where the attacker can catch the connection.

Attackers will often use port 80 as they can often rely on this being open.

79
Q

What is the difference between an exploit and the payload?

A

An exploit is what will allow you to run code on a system, payload is the code itself. Payloads are often encoded so that anti-virus programs or IDS won’t detect them.

Example payload: Reverse TCP connection back to an outside system from behind a firewall.

80
Q

What are the different types of payloads?

A
  • Inline: Shellcode is delivered in one block, single stage. A disadvantage is that it might be too big to deliver in a single stage.
  • Staged: First payload is just a stub that then grabs the rest of the payload and can be loaded into another memory space. This removing the problem of too little memory space.
  • Reversed: The payload on the exploited host connects back to the attacker. Good for inside firewalls.
81
Q

What is NoNX?

A

Payloads that are designed to circumvent Data Execution Protection (DEP)

82
Q

What is PassiveX?

A

Payloads that use ActiveX control to create a hidden instance of internet explorer for outbound access.

83
Q

What is Meterpreter?

A

“Mother of all payloads”
Operates by a DLL injection within windows.
Most common payload because of it being so flexible and can match up with different exploits.

84
Q

How are meterpreter payloads delivered?

A
  • Exploit is delivered on a system, allowing for code execution (Exploit + 1st stage payload)
  • Payload connects back to attacker
  • 2nd stage DLL injection payload is sent
  • Meterpreterserver send a full server DLL
  • The client and the server now communicates
85
Q

What is pivoting?

A

When one compromised machine is used to exploit other hosts or networks.
Once an attacker owns a machine within a firewall, they can launch further attacks from the compromised machine.

86
Q

What three things can be done during Post exploitation?

A

Persistence - Maintaining access
Removing forensic evidence
Ex-filtretion

87
Q

What is a NS record?

A

A NS record, or Name Server record, is a DNS record that contains the name of an authortive name server within a domain or DNS zone.

Information security (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions