Karteikarten
SCC 363
Karten in diesem Stapel (65)
- 1What is Lemma's Equation for mutual exclusionIf A and B are mutually exclusive, then:
Pr[AVB] = Pr[A] + Pr[B] - 2What is the equation for the probability of A happening?Pr[A] = 1-Pr[~A]
- 3What is Bayes Law?Let A and B be events with Pr[A], Pr[B]> 0 then:
Pr[A|B] = pr[B|A]Pr[A]/Pr[B] - 4What is a Transposition Cipher and give an example?This is where you don't change the letters, but you change the order of the letters.
An Example: Scytale - 5WHat is a Substitution Cipher and give an example?Letters are changed, but their order remains the same
- 6What is a Ciphertext-only attack (COA)?An attacker is assumed to have access to a set of ciphertexts
- 7What is a Known-plaintext attack (KPA)?A attacker is assumed to have access to both the plaintext and its corresponding ciphertext
- 8What is a Chosen-plaintext attack (CPA)?A attacker is assumed they can choose random plaintexts to be encrypted and obtain the corresponding ciphertext
- 9What is a Chosen-ciphertext attack (CC)?Where the cryptanalyst can gather information obtaining the decryptions of chosen ciphertexts
- 10What is Electronic Codebook (ECB)?You choose a single key and then encrypt each message block with the key
- 11What is Cipher Block Chaining (CBC)?Take plaintext split it into n blocks.
Then choose an IV (Initialisation vector).
To encrypt you then take the IV and then XOR it with the plaintext.
You then use the ciphertexts as the iV for the next encryption - 12What is counter (CTR) encryption?You have a IV which you encrypt.
You then XOR it with the message to produce the ciphertext - 13What is an adversary?Entity that attacks, or is a threat to a computing system
- 14Attack what are the three points in channels security?Confidentiality - Keeping data and resources hidden
Integrity - Data integrity, Origin integrity
Availability - Efficient transfer of information in the communication channel - 15What are the four classes of threats?Disclosure - Snooping
Deception - Modification, Spoofing, Repudiation of origin, denial of receipt
Disruption - Modification
Usurpation - Modification, Spoofing, delay, denial of service - 16What are the 4 Common Threats?Snooping - Unauthorised interception of information on/via a network
Falsification - Unauthorised change of information
Masquerading or Spoofing - An impersonation of one entity by another
Repudiation - A false denial that an entity received some information - 17What are Cookies?A small piece of data that is sent to the client and stored on the client side to allow for stateful information to be recorded.
- 18What are SQL Injections and how is it done?SQL injections are used to target a database of a website
It is done using an input area on the website and can be used to do multiple things such as bypassing authentication and retreiving information - 19How do you stop SQL Injections?Sanitise inputs and prepared SQL statements
- 20What is Cross Site Scripting (XSS) and how can it be done?Phishing - Putting a link in an email
Redirect - Insert code to redirect to malicious site
Reflected - Injected script is reflected off the web server
Stored - Injected code stored on server in the database, within file and served to all the users - 21What are fixes to stop Cross Site Scripting (XSS)Sanitization of all user inputs
Blacklisting vs. Whitelisting
Roll-your-own vs. reuse - 22What are the four steps in Cross-Site Request Forgery (CSRF)1) Victim logged into a vulnerable website
2) Victim visits the malicious page on attacker website
3) Malicious content is delivered to the victim
4) Victim involuntarily send a request to the vulnerable website - 23What are ways to fix Cross-Site Request Forgery (CSRF)Tokens - This is given every time a form served, add an additional parameter with a secret value and check that it is valid upon submission
Check referral header - The referral header, while changeable in your browser, cannot be spoofed by the attacker
Challange-response - CAPTCHA, Re-Authentication, One-time Token - 24What are the trade-offs when it comes to blocking?DNS blocking - Easy and cheap to implement, blocks at domain name granularity and trivial to bypass
IP blocking - Easy and cheap to implement and blocks at webpage level
Proxy blocking - Expensive to implement and blocks at webpage level
Hybrid blocking - Tricky to get right, but cheap, has some vulnerabilities and blocks at webpage level - 25What are the limitations of blocking?Censorship systems block legitimate content and fail to block banned content
Fairly easy for readers and publishers to circumvent the technical measures
Building and maintaining censorship systems is expensive
Blocking one type of content encourages other types to be blocked (over censorship)
Often the process of censorship is not transparent - 26What are the five areas which have reasons for privacy?Ordinary people - Avoid Personal information from being sold to marketers and protect themselves when researching sensitive topics
Militaries and law enforcement - carry out intelligence gathering, protect undercover field agents and offer anonymous tip lines
Journalists - protect sources such as whistle blowers
Human rights workers - publicise abuses and protect themselves from surveillance and blogging about controversial subjects
Businesses - observe their competition and build anonymous collaborations - 27What is Threshold Mix?In each round, the "threshold mix" accepts a fixed number of messages
Once the number reaches the "batch size" the mix flushes and sends them all, in a random order - 28What is Onion Routing?This is a path is chosen to the destination.
The message is then encrypted with public keys of the routers on the path.
Then each router on the path removes the outer layer (hence why its called onion routing). - 29What are limitations of Tor?Tor has multiple weaknesses:
traffic analysis
compromised exit nodes
heartbleed - 30What is Malware?This is any unwanted program that infects a computer such as: Worms, Viruses and Trojans
This is a set of instructions that run on your computer and make your system do something that an attacker wants it to do - 31What is Malware used for?It is used to:
Steal personal information
Delete file
Click fraud
Steal software serial numbers
Use your computer as a relay - 32What are the different types of Malware? (we talked about seven)Virus
Backdoor
Trojan Horse
Rootkit
Scareware
Adware
Worm - 33What is a Virus and what are the two types?This is a program that can infect other programs by modifying them to include a possibly evolved, version of itself.
The two types are:
Polymorphic - This uses a polymorphic engine to mutate while keeping the original algorithm intact
Metamorphic - change after each infection - 34What is a Trojan?This is something that describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow unauthorized access to the victim computer
- 35What is a Rootkit?This is a component that uses stealth to maintain a persistent and undetectable presence on the machine
- 36What is a Worm?This is a self-replicating computer program, it uses a network to send copies of itself to other nodes and do so without any user intervention
- 37What is a Botnet?This is a network of infected machines, under control from a "Botmaster", used for carrying out attacks including DDoS, and stealing information
- 38What is Advanced Persistent Threat (APT)This is a general term, referring to highly skilled, highly specialised attacks against western institutions
- 39What are the two types of topologies when it comes to malware command and control?Centralised
Decentralised - 40What is a centralised Botnet, also what is an advantage and disadvantage?Get a server
Giver malware address: hardcoded, Domain generation algorithm, Malware contacts server to get commands and server directly connects to malware to issue commands
Advantages: easy to set up, easy to maintain
Disadvantages: single point of failure - 41How is an IRC (Internet Relay Chat) creates and what are the benefits and downsides for IRC Bots?Botmaster hosts IRC server and creates a channel, bots then connect to channel and receive commands
Benefits: Easy to set up, Easy to maintain
Downside: Easy to block, Insecure and little anonymity - 42What is a Decentralised Botnet, what is an example, what is one advantage and disadvantage?Uses peer-to-peer architecture
Example: Storm
Advantages: Scalable, Robust and no single point of failure
Disadvantages: Much more complex to set up - 43What is Steganography?The art of information hiding
- 44What is DNS Fast Flux?Method for hiding C2 server, it works by website hiding behind zombie nodes and if there is a query then the domain will return a subset of the possible domains with a short TTL
- 45What are the three C&C controls?Blacklisting/Whitelisting - use firewalls to block known malicious traffic/only allow known good traffic
Sinkholing - Force traffic to a controlled location
Partitioning - Attack against decentralised architectures, "partition" network enough that communication cannot occur - 46What are the 6 malware variants?Adware
Spam Campaigns
Phishing Sites
Key Loggers
Social Malware
Ransomware - 47What is a rootkit and what are the two types of rootkits?Rootkits provide administrator-level access to a computer or network
Userland Rootkit - Runs application and can inject malicious dlls into other applications
Kernel Rootkit - Replaces portions of the core operating system (kernel, device drivers) - 48What are the five steps in DLL Injection?Step 1+2 - Create 2 malicious DLLs
Step 3 - API call to "VirtualAllocEx" makes space for malicious DLLs, and explorers.DLL is written to explorer.exe
Step 4 - Explorer.DLL grabs inside iexplorer.DLL
Step 5 - Explorer.DLL writes the code of iexplorer.DLL into explorer.DLL with API call "WriteProcessMemory" - 49What is a Bootkit?Kernel-mode rootkit that infects startup code such as MBR
BootKits can be used to avoid all protections of an OS, because OS consider that the system was in trusted sates the moment the OS boot loader took control - 50What is a Hypervisor Rootkit?Run the target OS inside a VM so can intercept all hardware calls and is also currently theoretical
- 51What is a Worm?This is a self-replicating malware designed to spread through the network
- 52What are the differences between a Worm, Virus and Trojan horse?A Virus is code embedded in a file or program.
Viruses and Trojan horses rely on human intervention
Worms are self-contained and may spread automatically - 53What are the 6 was worms can propagate?Scanning worms - Worm chooses "random" address
Coordinated scanning - Different worm instances scan different addresses
Flash worms - Assemble tree of vulnerable hosts in advance and propagate along the tree
Meta-server worm - Ask server for hosts to infect
Topological worm - Use information from infected hosts
Contagion worm - Propagate parasitically along with normally initiated communication - 54What are the two main approaches when it comes to detecting host-based malware?Signature-based detection
Heuristic-based detection - 55What is Virus Signature detection, what are the benefits and drawbacks?Find a "string" that can identify the virus
match new samples to known signatures
Benefits: Fast and Accurate to known samples
Drawbacks: Bad for new samples and easily evadable - 56What is Heuristic Based Detection for a Virus, what is an advantage and disadvantage?Analyse program behaviour (Network access, file open, attempt to delete file and attempt to modify the boot sector)
Throw an alert when unusual behaviour is seen
Advantage: Better for catching new malware
Disadvantage: Can still miss things and be evaded - 57What is Sandbox Analysis?A primary way of collecting malware data, run malware in a controlled environment and log all system calls, memory usage and network traffic.
- 58What is a Honeypot?Setup a vulnerable machine, Make accessible on the internet and wait for the infection to occur. Run as a sandbox, and collect data (this is good for new malware)
- 59What are the current detection mechanisms for C&C?Traffic clustering - C&C traffic is different from legitimate traffic
Traffic classification - C&C traffic is not only different but has static behavioural characteristics
Graph-based approaches - C&C uses different communication structures than other applications - 60What is the Barreno Model (Which is to do with classifying attacks)?Influence:
Causative - Alter the training process through the influence of the training data
Exploratory - Do not change training data, but use techniques such as probing or offline analysis to discover information
Specificity:
Targeted - Focus a particular point, or set of points
Indiscriminate - Attacker has a flexible goal, such as to increase false positives
Security Violation:
Integrity - Results in intrusion points being labelled as normal
Availability - Results in many classification errors that increase both false negatives and false positives, resulting in system becoming unusable - 61What are the four reasons why secure machine learning not in use?Lack of awareness - System designers do not follow ML literature and so are not aware
Ease of access - Lack of existing implementations of secure algorithms or difficulties in implementing
Reduced performance - Secire versions have lower TP/FP rates in normal scenarios so are less attractive
Lack of clear security metrics - While plenty of easy to follow metrics exists for measuring performance, no clear metrics for easily evaluating security perfomance - 62What are the two common defences against Malware?Multi-classifier approaches - Use multiple classifiers trained using different feature or datasets
Game-theoretical approaches - Incorporate attacker strategies into learning algorithms - 63What are the limitations of defences against malware?Simple evaluation scenarios against single attacks
Game theoretical approaches rely on attack playing the game - 64How does the Bell-LaPadula model (BLP) work?S can read O if and only if Lo <= Ls
S can only write O if and only if Ls <= Lo
"Read down; Write up" - 65How does the BIBA Model work?This is concerned with integrity
S can read O if and only if Is <= Io
S can write O if and only if Io <= Is
Informationen
- Beschreibung
- Degree Computer Science 3rd Year Karteikarten am SCC 363, erstellt von Robert Carr am 11/05/2018.
- Erstellt von
- Robert Carr
- Aufrufe
- 0
- Bewertung