quiz 8 Flashcards
In Microsoft systems, an excellent resource for finding configuration errors, missing patches, and so on is the ________________________________________.
Microsoft Baseline Security Analyzer
MBSA
Microsoft Baseline Security Analyzer (MBSA)
What functions do most Trojan programs perform?
Most Trojan programs perform one or more of the following functions:
- Allow remote administration of the attacked system
- Create a file server on the attacked computer so files can be loaded and downloaded without the user’s knowledge
- Steal passwords from the attacked system and e-mail them to the attacker
- Log all keystrokes a user enters and e-mail the results to the attacker or store them in a hidden file the attacker can access remotely
What is the Common Internet File System (CIFS) protocol?
Common Internet File System (CIFS) is a standardized protocol that replaced SMB in Windows 2000 Server and later, but to allow backward compatibility, the original SMB is still used. CIFS is a remote file system protocol that enables computers to share network Windows OS Vulnerabilities 207 resources over the Internet. In other words, files, folders, printers, and other resources can be made available to users throughout a network. For sharing to occur, there must be an infrastructure that allows placing these resources on the network and a method to control access to resources.
To perform MBSA-style scans you can run the tool from the command line by using ____________________.exe.
mbsacli
Rootkits containing Trojan binary programs ready to be installed are more dangerous than typical Trojan programs.
True
To determine whether a system is vulnerable to an RPC-related issue, the best tool is ____.
MBSA
The Conficker worm took advantage of a vulnerability in ____ to run arbitrary code on susceptible hosts
RPC
____ is an open-source implementation of CIFS.
Samba
If the LRK5 rootkit is installed on a Linux computer, entering the Trojaned ____ command allows the attacker’s processes to continue running, even though the Linux administrator thinks all processes were killed.
Killall
MBSA has its origins in the ____ scanner.
HFNetChk
The Trojan program called Sheepshank makes HTTP GET requests over port ____.
80
Samba is as an closed-source implementation of CIFS.
False
If the LRK5 rootkit is installed on a Linux computer, entering the Trojaned ____ command allows the attacker’s processes to continue running, even though the Linux administrator thinks all processes were killed.
Killall
Trusted Computer Solutions____ program is used to tighten Linux system security configuration by using templates.
Security Blanket
The best way to protect a network from SMB attacks is to make sure routers filter out ports 137 to 139 and ____.
445
Complete instructions for MBSA are available from the MBSA Help interface or the ____ site.
Microsoft Security Tools Web
Early Windows OSs communicated with each other by using ____.
NetBIOS
What is the purpose of a file system?
The purpose of any file system, regardless of the OS, is to store and manage information. The file system organizes information that users create as well as the OS files needed to boot the system, so the file system is the most vital part of any OS. In some cases, this critical component of the OS can be a vulnerability.
SMB stands for _________________________.
Server Message Block
The MBSA can check for missing security updates.
True
Red Hat and Fedora Linux use the ____ command to update and manage RPM packages.
yum
Why should you review logs regularly? How should you accomplish this task?
You should review logs regularly for signs of intrusion or other problems on the network. Scanning through thousands of log entries is time consuming, and missing important entries is likely. A log-monitoring tool is best for this task. Several are available, depending on network needs and budget.
What can a security tester using enumeration tools do?
A security tester using enumeration tools can do the following:
- Identify a computer on the network by using port scanning and zone transfers
- Identify the OS the computer is using by conducting port scanning and enumeration
- Identify via enumeration any logon accounts and passwords configured on the computer
- Learn the names of shared folders by using enumeration
- Identify services running on the computer
What is Samba used for?
Samba is an open-source implementation of CIFS. With Samba, *nix servers can share resources with Windows clients, and Windows clients can access a *nix resource without realizing that the resource is on a *nix computer. For a Windows computer to be able to access a *nix resource, CIFS must be enabled on both systems. On networks that require *nix computers to access Windows resources, Samba is often used. It’s not a hacking tool; this product was designed to enable *nix computers to “trick” Windows services into believing that *nix resources are Windows resources. A *nix client can connect to a Windows shared printer and vice versa when Samba is configured on the *nix computer. Most new versions of Linux include Samba as an optional package, so you don’t need to download, install, and compile it.
