Software Security Tools 2.2

Question 1

Passive Tools

Answer 1

Passive security is observing packets and learning. Observing frequent talkers, servers, clients, apps, OS’s, services.

Question 2

Active Tools

Answer 2

Sending traffic to a device and observing the results. Query a login page, try a known vulnerability, actively checking for vulnerabilities.

Question 3

Protocol Analyzer

Answer 3

Helps solve complex issues by getting details. Gathers packets on the wired network or wirelessly. Sometimes the ability to capture the packets are built into the device. Views traffic patterns and identifies unknown or unusual traffic. Stores large amounts of data to create big data analytics.

Question 4

Network Scanners

Answer 4

Commonly used to determine what services or OS are running on a remote device. These are commonly told to scan a range of IP addresses in order to find what’s out there. It can then visually map the network based on what it’s found.

Question 5

Wireless Scanners and Crackers

Answer 5

You need tools to find out what kind of traffic is traversing your wireless network. You also need tools to see if your wireless access points are vulnerable to attacks. Additional tools to see if it easy to crack a password on your network.

Question 6

Password Crackers

Answer 6

Passwords are stored as hashes in most cases. You can turn a pass and turn it into a hash but no way to take a hash and turn it back into a pass. If a hash is stored without and protection such as salting or using a weak hashing algorithm, these hash’s can be brute forced or compared with rainbow tables.

Question 7

Vulnerability Scanners

Answer 7

Used to check if you are up to date on security patches. Minimally invasive unlike a penetration test. Gathers as much info as possible and sort information out later.

Question 8

Configuration Compliance Scanners

Answer 8

Does your device meet minimum security configs? Helpful if you need to comply with internal requirements ore industry regulations. Checks devices for detailed information about your OS versions, installed apps, network setting, anti-virus settings and versions, server configs, etc. Information about all devices are stored on a database and its able to detect if a certain login is coming from a new or updated device.

Question 9

Exploit Framework

Answer 9

Attackers keep blueprints of previously used or commonly used exploits. They take the blueprint, add code and test the waters. For example, RouterSploit is a router exploitation framework.

Question 10

Data Sanitization Tools

Answer 10

Generally if you overwrite the data on a hard drive, its gone forever. There is software to assist with ensuring this occurs.

Question 11

Steganography Tools

Answer 11

Finding an invisible message concealed into an image. Data can also be hidden in network packets.

Question 12

Honeypots

Answer 12

Traps designed to entice attackers to waste time. The honeypots can be very elaborate such as creating a large server farm that exists only in a virtual world. Bad guys are aware of these and actively try to avoid them.

Question 13

Backup Tools

Answer 13

Real-time file sync, hourly backups, full complete backups. Make sure every device is covered.

Question 14

Banner Grabbing

Answer 14

Applications provide information about themselves when you first connect to it. Some give too much information. They sometimes give information about the server they are running on. This data can be captured and used for intel.