GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Volume 2: Network Security

Tim Jelly English 59 cards

Cards in this deck (59)

  1. 1A router has an internal and external IP, what are these for?Internal - default gateway which communicates with the devices on your network
    External - IP that communicates with the web
  2. 2Network Address Translation (NAT)Where a router assigns a public IP to a device on your network - this means that internet cannot go directly to your device without going via the router (unless port forwarding is configured)
  3. 3What makes up a 'router'?Modem, Router, Firewall, Switch, Wireless access point
  4. 4Function of port: 20/21 22 80 44320/21 - FTP (File transfer Protocol)
    22 - Remote login protocol (SSH)
    80 - HTTP
    443 - HTTPS
  5. 5What is used to identify devices and send traffic within your networkMAC addresses
  6. 6Why do switches offer security?They have security collision domains - you can't sniff traffic on the network with a switch as the traffic gets forwarded to the correct physical LAN port based on the MAC address.
    (Can be defeated by ARP spoofing)
  7. 7IP tables?Routers allow and deny traffic based on IP tables.
    These work on the network and transport layers (layers 3 and 4)
  8. 8Function of a router?Passes network traffic from your local network to the internet
  9. 9Function of a modemModulate and demodulate the signal so it can be passed onto the local loop of you network carrier (works at layer 2)
  10. 10Function of a wireless access point (WAP)Wireless transmitter and receiver (similar to a switch but for wireless)
    Uses the MAC addresses of your devices to send traffic (works at data link layer, layer 2)
  11. 11DHCP?Dynamic Host Configuration Protocol - assigns your IP addresses to your devices
  12. 12DNS?Domain Name Servers - resolves domain names into IP addresses
  13. 13ShodanA search engine for vulnerable devices
  14. 14UPnP (Universal plug and play)This allows port forwarding to set up automatically (Disable on your router)
  15. 15Tool that can be used to map the local network?Nmap or Zenmap (GUI for nmap)
  16. 16What is the benefit of custom router firmware?Most home routers have basic firmware and does not support serious configeration for security, may have backdoors and have poorer performance.
    DDWRT provides good custom router firmware
  17. 17How do firewalls work?Allow and deny traffic based on an access control list
    Most work on the network/transport layers to accept/reject traffic based on port protocol and address
  18. 18How does an application based firewall differ?They can specificy what traffic they allow through which port.
    e.g only allow HTTPS through port 443
    Work on the application layer (layer 7)
  19. 19Ingress and egress filtering?Ingress in inbound traffic filtering
    Egress is outbound traffic filtering (stops malware communicating back to its command and control centre)
  20. 20Host based firewall?Based on the OS
    e.g windows has MS firewall
    Linux has IP tables
    Can be used to block all untrusted traffic
  21. 21What is: Reverse shell Shell code Shell commandReverse shell - connection outbound
    Shell code - code that runs these connections
    Shell command - a reverse shell often creates a shell command
  22. 22Examples of Internet of Things devicesSmart TV, Printer, Phone, Security Camera etc
  23. 23Two types of firewalls?Network based firewall
    -Just allows / disallows ports
    Host based firewall
    -They can understand what apps are running on the device (white listing)
    -Potentially on same platform as the malware
  24. 24Virtual Firewalle.g a zen server that has one of its virtual machines acting as a firewall
    Can nest VPNs or prevent leaks from VPNs
  25. 25VPNVirtual Private Network
  26. 26Dynamic Access Control ListWhen a connection is made, a source port is sent and remembered - only need to allow the outbound connection, inbound connection will then open until it is closed with a FIN or RST packet
  27. 27UFWIs a front end for Linux IPtables
  28. 28Network IsolationPhysically / logically separating devices on different networks
    - prevents malware propagating across the network
  29. 29ARPAddress Resolution Protocol is a protocol for mapping an internal IP address to a MAC address
    An ARP cache is used to maintain a correlation between each MAC and corresponding IP
  30. 30ARP spoofingAn attacker fools other devices on the network into believing that the attacker is the default gateway (router) by abusing ARP (data link layer)
    -Attacker can observe, record and inject into traffic
  31. 31VLANA virtual LAN (logical separation)
    -Works at data-link layer (layer 2)
    -Man in the middle attack can only be performed inside that VLAN
  32. 32Methods of network isolationVLANs
    Switch for ethernet connections
    Wifi
    Overlay VPNS network on top of the physical network - this encrypts allt he traffic
  33. 33WEP weaknessesUse of static encryption keys (no session keys)
    Lack of packet integrity assurance
    Ineffective use of initialization vectors (IVs) - without IVs, two identical plain text values are encyrpted into the same cypher text
  34. 34CCMP (Counter Mode Cypher Block Chaining Message Authentication Protocol)Mandatory replacement for WEP since 2006
    (Often referred to as AES, as it uses AES based encryption)
  35. 35SSIDService Set Identifier (Network name e.g SKY1020)
    -If SSID is common, hackers can pre-compute common passwords with common SSIDs to make cracking faster (rainbow tables)
  36. 36Wifi AttacksReaver - cracks 8-digit WPS PIN
    Evil Twin Network - Another WifI network with same SSID - if signal is stornger, your device will automatically connect
    Can both lead to SSL stripping or MiM attacks
  37. 37Fearn Wifi crackerGui front end for Wifi cracking
  38. 38Wireless security measuresComplex passwords
    Encrypt network traffic (TLS and VPNs)
    Disable WPS
    Arpspoof protectin (e.g on pfSense)
    VPN overlay
  39. 39WiresharkGUI for protocol analyzers - packet inspection
  40. 40TCPTransmission Control Protocol
    Layer 4 (transport layer)
    TCP segements and UD UDP datagrams are the data units
  41. 41HTTPHyper Text Transfer Protocol
  42. 42Sources of tracking online-Email providers
    -Third party websites
    -Governments
    -HTTPS content can be viewed on a company's machine by placing trusted certificates on your client
    -Public WiFis
    -Man in the middle attack
    -RATS / keyloggers
    -Local Network
  43. 43When are IP addresses assigned?They are assigned dynamically when you connect to the internet
  44. 44How is burp suite used?A proxy is installed between your browser and the website - you can see all thte traffic, including 3rd party websites and cookies
  45. 45CookiesCookies store settings
    -Session cookies are used when you log into a website, so that you do not have to log in every time
  46. 46Super cookiesVery resillient - Cannot be deleted like normal cookies
  47. 47Browser fingerprinting-The more average and default you browser, the less unique the 'fingerprint'
    -Includes things like cookies, addons / plug-ins etc
    -Adopt either uniformity (default) or randomisation (e.g random agent spoofer) as mitigation
  48. 48Actions for privacy online-Enable private browsing
    -Use HTTPS
    -Use privacy focused serach engine
    -Hardened browser
    -Anonymising services (VPNs, Tor etc)
    -uBlock origin (HTTP filter and track blocker)
    -Use a non-persistant OS (e.g VM snapshot)
  49. 49How to reduce the browser acttack surface-Unistall/disable anything not used
    -Quick java - disable Flash, Java and JS
  50. 50Methods of browser isolation and compartmentalisation-Cloud browsing - done on a remote server, you only see an image of the browser
    -Sandboxing e.g sandboxie
    -Profiles on Firefox
  51. 51Three methods of password cracking1. Dictionary attacks
    2. Brute force attack
    3. Hybrid attack
    Can be done online or offline
  52. 52Online vs offline password crackingOnline - extremely slow, can block IP
    Offline - possible when attackers have access to password hashes
    -trying to convert hashes into plain text
    -users send a copy of the hash which is compared for login
  53. 53PBKDF2Password-based key derivation function (key stretching function)
    -A salt value is concatinated with the password, hashed and process repeated n times (5000-15000 for secure online, 150,000 when stored on company servers)
    -Final hash then encrypted
  54. 54HaschatKali Linux tool - need a set of hashes to crack (can download from rainbow tables)
  55. 55Password managerse.g last pass - enable strong and unique passwords that do not have to be remebered
    -locked using astrong master password that is put through the PBKDF2
  56. 56Strength of a passwordEntropy is important - patterns make passwords easily cracked
    Very long passwords (40+ characters) - patterns no longer matter
  57. 57Multi-Factor AuthenticationAn extra form of authentication:
    -Something you know (PIN)
    -Something you have (bank card, nitrokey)
    -Something a person is (thumb scan)
  58. 58Hard tokens vs soft tokensHard token - physical hardware (nitrokey) that provides MFA
    Soft token - software that can provide MFA
    Both methods have an attack surface.
  59. 59Future of passwordSQRL (squirrel) - scanning QR codes
    or
    Cleft - scanning in a similar code

Information

Description
Flashcards on Volume 2: Network Security, created by Tim Jelly on 18/06/2017.
Created by
Tim Jelly
Views
12
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?