Fichas
Volume 2: Network Security
Fichas del conjunto (59)
- 1A router has an internal and external IP, what are these for?Internal - default gateway which communicates with the devices on your network
External - IP that communicates with the web - 2Network Address Translation (NAT)Where a router assigns a public IP to a device on your network - this means that internet cannot go directly to your device without going via the router (unless port forwarding is configured)
- 3What makes up a 'router'?Modem, Router, Firewall, Switch, Wireless access point
- 4Function of port: 20/21 22 80 44320/21 - FTP (File transfer Protocol)
22 - Remote login protocol (SSH)
80 - HTTP
443 - HTTPS - 5What is used to identify devices and send traffic within your networkMAC addresses
- 6Why do switches offer security?They have security collision domains - you can't sniff traffic on the network with a switch as the traffic gets forwarded to the correct physical LAN port based on the MAC address.
(Can be defeated by ARP spoofing) - 7IP tables?Routers allow and deny traffic based on IP tables.
These work on the network and transport layers (layers 3 and 4) - 8Function of a router?Passes network traffic from your local network to the internet
- 9Function of a modemModulate and demodulate the signal so it can be passed onto the local loop of you network carrier (works at layer 2)
- 10Function of a wireless access point (WAP)Wireless transmitter and receiver (similar to a switch but for wireless)
Uses the MAC addresses of your devices to send traffic (works at data link layer, layer 2) - 11DHCP?Dynamic Host Configuration Protocol - assigns your IP addresses to your devices
- 12DNS?Domain Name Servers - resolves domain names into IP addresses
- 13ShodanA search engine for vulnerable devices
- 14UPnP (Universal plug and play)This allows port forwarding to set up automatically (Disable on your router)
- 15Tool that can be used to map the local network?Nmap or Zenmap (GUI for nmap)
- 16What is the benefit of custom router firmware?Most home routers have basic firmware and does not support serious configeration for security, may have backdoors and have poorer performance.
DDWRT provides good custom router firmware - 17How do firewalls work?Allow and deny traffic based on an access control list
Most work on the network/transport layers to accept/reject traffic based on port protocol and address - 18How does an application based firewall differ?They can specificy what traffic they allow through which port.
e.g only allow HTTPS through port 443
Work on the application layer (layer 7) - 19Ingress and egress filtering?Ingress in inbound traffic filtering
Egress is outbound traffic filtering (stops malware communicating back to its command and control centre) - 20Host based firewall?Based on the OS
e.g windows has MS firewall
Linux has IP tables
Can be used to block all untrusted traffic - 21What is: Reverse shell Shell code Shell commandReverse shell - connection outbound
Shell code - code that runs these connections
Shell command - a reverse shell often creates a shell command - 22Examples of Internet of Things devicesSmart TV, Printer, Phone, Security Camera etc
- 23Two types of firewalls?Network based firewall
-Just allows / disallows ports
Host based firewall
-They can understand what apps are running on the device (white listing)
-Potentially on same platform as the malware - 24Virtual Firewalle.g a zen server that has one of its virtual machines acting as a firewall
Can nest VPNs or prevent leaks from VPNs - 25VPNVirtual Private Network
- 26Dynamic Access Control ListWhen a connection is made, a source port is sent and remembered - only need to allow the outbound connection, inbound connection will then open until it is closed with a FIN or RST packet
- 27UFWIs a front end for Linux IPtables
- 28Network IsolationPhysically / logically separating devices on different networks
- prevents malware propagating across the network - 29ARPAddress Resolution Protocol is a protocol for mapping an internal IP address to a MAC address
An ARP cache is used to maintain a correlation between each MAC and corresponding IP - 30ARP spoofingAn attacker fools other devices on the network into believing that the attacker is the default gateway (router) by abusing ARP (data link layer)
-Attacker can observe, record and inject into traffic - 31VLANA virtual LAN (logical separation)
-Works at data-link layer (layer 2)
-Man in the middle attack can only be performed inside that VLAN - 32Methods of network isolationVLANs
Switch for ethernet connections
Wifi
Overlay VPNS network on top of the physical network - this encrypts allt he traffic - 33WEP weaknessesUse of static encryption keys (no session keys)
Lack of packet integrity assurance
Ineffective use of initialization vectors (IVs) - without IVs, two identical plain text values are encyrpted into the same cypher text - 34CCMP (Counter Mode Cypher Block Chaining Message Authentication Protocol)Mandatory replacement for WEP since 2006
(Often referred to as AES, as it uses AES based encryption) - 35SSIDService Set Identifier (Network name e.g SKY1020)
-If SSID is common, hackers can pre-compute common passwords with common SSIDs to make cracking faster (rainbow tables) - 36Wifi AttacksReaver - cracks 8-digit WPS PIN
Evil Twin Network - Another WifI network with same SSID - if signal is stornger, your device will automatically connect
Can both lead to SSL stripping or MiM attacks - 37Fearn Wifi crackerGui front end for Wifi cracking
- 38Wireless security measuresComplex passwords
Encrypt network traffic (TLS and VPNs)
Disable WPS
Arpspoof protectin (e.g on pfSense)
VPN overlay - 39WiresharkGUI for protocol analyzers - packet inspection
- 40TCPTransmission Control Protocol
Layer 4 (transport layer)
TCP segements and UD UDP datagrams are the data units - 41HTTPHyper Text Transfer Protocol
- 42Sources of tracking online-Email providers
-Third party websites
-Governments
-HTTPS content can be viewed on a company's machine by placing trusted certificates on your client
-Public WiFis
-Man in the middle attack
-RATS / keyloggers
-Local Network - 43When are IP addresses assigned?They are assigned dynamically when you connect to the internet
- 44How is burp suite used?A proxy is installed between your browser and the website - you can see all thte traffic, including 3rd party websites and cookies
- 45CookiesCookies store settings
-Session cookies are used when you log into a website, so that you do not have to log in every time - 46Super cookiesVery resillient - Cannot be deleted like normal cookies
- 47Browser fingerprinting-The more average and default you browser, the less unique the 'fingerprint'
-Includes things like cookies, addons / plug-ins etc
-Adopt either uniformity (default) or randomisation (e.g random agent spoofer) as mitigation - 48Actions for privacy online-Enable private browsing
-Use HTTPS
-Use privacy focused serach engine
-Hardened browser
-Anonymising services (VPNs, Tor etc)
-uBlock origin (HTTP filter and track blocker)
-Use a non-persistant OS (e.g VM snapshot) - 49How to reduce the browser acttack surface-Unistall/disable anything not used
-Quick java - disable Flash, Java and JS - 50Methods of browser isolation and compartmentalisation-Cloud browsing - done on a remote server, you only see an image of the browser
-Sandboxing e.g sandboxie
-Profiles on Firefox - 51Three methods of password cracking1. Dictionary attacks
2. Brute force attack
3. Hybrid attack
Can be done online or offline - 52Online vs offline password crackingOnline - extremely slow, can block IP
Offline - possible when attackers have access to password hashes
-trying to convert hashes into plain text
-users send a copy of the hash which is compared for login - 53PBKDF2Password-based key derivation function (key stretching function)
-A salt value is concatinated with the password, hashed and process repeated n times (5000-15000 for secure online, 150,000 when stored on company servers)
-Final hash then encrypted - 54HaschatKali Linux tool - need a set of hashes to crack (can download from rainbow tables)
- 55Password managerse.g last pass - enable strong and unique passwords that do not have to be remebered
-locked using astrong master password that is put through the PBKDF2 - 56Strength of a passwordEntropy is important - patterns make passwords easily cracked
Very long passwords (40+ characters) - patterns no longer matter - 57Multi-Factor AuthenticationAn extra form of authentication:
-Something you know (PIN)
-Something you have (bank card, nitrokey)
-Something a person is (thumb scan) - 58Hard tokens vs soft tokensHard token - physical hardware (nitrokey) that provides MFA
Soft token - software that can provide MFA
Both methods have an attack surface. - 59Future of passwordSQRL (squirrel) - scanning QR codes
or
Cleft - scanning in a similar code
Información
- Descripción
- Fichas sobre Volume 2: Network Security, creado por Tim Jelly el 18/06/2017.
- Creado por
- Tim Jelly
- Visitas
- 12
- Valoración