Flashcards
Security and Risk
Cards in this deck (149)
- 1What is mutual exclusion?When two events A and B are are not possible at the same time
- 2What is a random variable?A variables used in probability to denote a random value
e.g. the outcome of a dice roll - 3what is an independent event?Two events A and B are independent if knowing whether A occurs does not tell us anything about whether B occurs
- 4what is a transposition cipher?we do not change the letters, but change their order
- 5what is a substitution cipher?letters are changed, but their order remains the same
e.g. shift cipher, substitution cipher - 6what is a ciphertext only attack?when the attacker only has knowledge of the ciphertext
the attack is successful if the plain text is deduced - 7what is monoalphabtetic ciphereach letter is always encoded to the same letter
- 8what is a polyalphabetic cipher?a shift cipher with different keys on different text positions
- 9the three steps in cryptography?1. Precisely sepcify threat model
2. Propose a construction
3. Prove that breaking the construction under the threat model will solve an underlying hard problem - 10What does perfect secrecy mean?Perfect secrecy means that observing the ciphertext should not change the attacker's knowledge about the distribution of the plaintext
- 11drawback of OTP?Key must be as long as the message
- 12what is an adversary?an entity that attacks, or is a threta to, a computing system
- 13what is a security service?prevents bad things from happening
- 14what is a security policy?defines what is good and bad
- 15what is the Holistic perspective of securitySecurity is only as good as the weakest link
- 16what are the channel security concepts?Confidentiality
Integrity
Availability - 17network security concepts?Anonymity
- unlinkability
- unobservability
- untraceability
Availability
- enabling access to data and resources - 18additional security concepts?Authenticity
Accountability
Threat
Vulnerability
Attack - 19what is a threat?a set of circumstances that has the potential to cause loss or harm. Or potential violation of security
- 20what is a vulnerability?a weakness in the system that could be exploited to cause loss or harm
- 21what is an attack?when an entity exploits a vulnerability on a system. Strategic noise; not random error
- 22what are the classes of threats?Disclosure
Deception
Disruption
Usurpation - 23What is a security policy?a statement of what is allowed in a networked system and what is not allowed
- 24what is a security mechanism?a method, tool or policy for enforcing a security policy
- 25what should a security policy document lay out?The overall objectives
The principles
And the underlying threat model that are to guide the choice of mechanism in the next step - 26what is path traversal?easy to guess pages on websites
e.g. www.site.com/admin.php - 27fixes for path traversal?use different filenames?
require authentication for hidden pages
remove from google - 28what is XSS redirect?attacker inserts code that redirects user to malicious site
- 29what is reflected XSS?injected script is reflected off the web server
only the issuer is affected - 30what is stored XXS?Injected code is stored on web server in database, within files and served to all users
- 31CSRF fixes?Check the referral header
Challenge-response
e.g. CAPTCHA - 32Name the different blocking systemsDNS blocking
IP blocking
Proxy blocking
Hybrid blocking - 33How is traffic anonymity achieved?by making all traffic look the same (padding) and hiding timing correlations (delays)
- 34what is malware?any unwanted program that infects a computer
- 35different types of malware?Worms
Viruses
Trojans - 36what is a virus?a program that can infect other programs by modifying them to include a possibly evolved version of itself
- 37different types of viruses?Polymorphic: uses a plymorphic engine to mutate while keeping the original algorithm intact (packer)
Metamorphic: change after each infection - 38what is a trojan?A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow unauthorised access to the victim computer
- 39what is a routekit?A root kit is a component that uses stealth to maintain a persistent and undetectable presence on the machine
- 40what is a worm?a computer worm is a self-replicating computer program. It uses a network to send copies of iself to other nodes, and do so without any use intervention
- 41what is a botnet?A botnet is a network of infected machines, under control from a "botmaster", used for carrying out attacks including DDoS, and stealing information
- 42What does APT stand for?Advanced Persistent Threat
- 43what is APT?In a general term, referring to highly skilled, highly specialised attacks against western institutions
- 44advantages of cenralised malware?easy to set up
easy to implement - 45disadvantages of malware?single point of failure
- 46what is steganography?hiding data
e.g. trojan.downbot - hiding commands in HTML comments - 47two main approaches to detecting host based malware?signature based
heuritsic based - 48what is signature based detection?find a string in the program that can identify it as a virus
e.g. system calls - 49what is heuritsic based detection?analyse program behaviour
throw alert when unusal behviour is seen - 50Current C&C detection mechanisms?Traffic clustering
Traffic classification
Graph-based approaches - 51What is auto-start?Malware needs to be run automatically when the host machine is booted
- 52what is the access control matrix?Abstract security model in OS
Characterises rights of domains (users) with respect to objects (files, processes etc)
A 2D array of cells, where x is the subject, and y is the objects
Cell x,y shows right of subject x for object y - 53Why should access control matrix be used in the real world?Storing a matrix for a whole file system would use a lot of memory
- 54Alternatives to Access Control Matrix?Access Control Lists
Capabilities - 55What are Access Control Lists?Storing the domains(users) capabilities with the file
- 56What are Capabilities in OS security in regards to Access Control?Storing file capabilities with domains(users)
- 57How are unix file permission command line structured?
- 58what are the symbols for unix file types?"-" = file
"d" = directory - 59what are the number of hard links in unix file permission command line?The number of references to the file on disk
A file can be referenced in different places with different names - 60How to change permissions in unix?Use $chmod command
- 61How is the chmod command structures?$chmod
e.g.
$chmod o+r-- myfile - 62What are octals?A method for setting access permissions in unix using numbers
- 63what is privilege escalation?Utilising a bug or badly designed program to access resources you do not have permission for
- 64What are the two types of privilege escalation?Vertical escalation
Horizontal escalation - 65What is vertical escalation?Lower level user accesses function of content reserved for higher privilege user
e.g. admin - 66what is horizontal escalation?Normal user accesses functions or content reserved for other normal users
e.g. User A accesses photos directory for user B - 67what is a buffer overflow attack?Buffer overflow attack occurs when a program tries to put more in a buffer than the amount of memory allocated to it
- it then overwrites adjacent memory locations - 68What are techniques for defending against buffer overflow attacks?Stack canaries
Randomisation - 69What are stack canaries?A defence against buffer overflow attacks
Values are placed around the stack (usually between buffer and control data), which can be tested later
If stack is overwritten, values will change and can be detected - 70What is Randomisation in OS security?Layout of memory is changed to make it harder to find the correct memory address to attack/jump to
Not 100% effective, just makes the attack harder - 71Name 3 basic network security problems?1. Network packets pass by untrusted hosts
- eavesdropping, sniffing
2. TCP state can be easy to guess
- spoofing and session hijacking
3. DoS vulnerabilities - 72what is ARP spoofing?Attacker send spoofed ARP response for target with their own MAC address
All traffic for target IP is routed to attackers address
- useful for sniffing - 73what is TCP connection spoofing?Predicting TCP handshake sequence numbers to spoof a connection between the server and the victim, when the attacker is actually sending the commands
- 74How can the attacker predict random sequence numbers in a TCP connection?Attacker repeatedly connects to server
Obtains sequence of SN's
Can now predict the next SN
Now attacker can TCP spoof - 75What is BGP?A protocol used for routing between Autonomous Systems
Finds the shortest path, in terms of number of AS's the packet will need to traverse through - 76What are the security vulnerabilities in BGP?BGP packets are un-authenticated
- attacker can inject advertisements for arbitrary routes
- advertisement will propagate everywhere
- used for DoS and spam
Human error problems
- mistakes quickly propagate to entire internet - 77what is an LSA?Link State Advertisement
Flooded throughout an AS so that all routers in the AS have a complete view of the AS topology - 78what is the "fight back mechanism"?A security feature in OSPF protocol
If a router receives its own LSA with a newer timestamp than the latest it sent, it immediately floods a new LSA - 79Name a vulnerability and the solution ot DNSUsers/hosts trust host-address mapping provided by DNS
Interception of requests or compromise of DNS servers can result in incorrect or malicious responses
Solution: authenticated requests/responses
- provided by DNSsec - 80What is DNS cache poisoning?Attacker acts as a site sending a DNS server its IP address to be cached
e.g.
a user look ups a bank IP address
DNS server requests bank for the ip address
Attacker acts as the bank sending its IP address as its own
It does this by predicting the query ID - 81What are some defences to DNS cache poisoning?Increase query ID size
by either:
1. Randomise src port, adds another 11 bits
2. Ask every DNS query twice - 82what is the same origin policy?Security policy in which script on one web page can access data in second, as long as theyre from the same origin
- 83defences to DNS rebinding attack?Browser mitigation: DNS Pinning
- refuses to switch to new IP
Server-side defences
- Check host header for unrecognised domain
- Authenticate users with something other than IP
Firewall defences
- External names cant resolve to internal addresses
- Protects browsers inside the organisation - 84what is a DoS attack?Denial of Service attack
an action that prevents or impairs the authorised use of networks, systems or applications by exhausting resources such as central processing units (CPU), memory, bandwidth and disk space - 85what is a semantic attack?exploit known vulnerability in protocol or application to consume excessive amounts of resources
- 86How do SYN flood attacks work?- Attack sends repeated TCP SYN messages to the target
- Target replies with SYN/ACK but attacker never responds
- Each time SYN is sent, target has to store half open connection
- Each connection required a 280 bytes TCP control block (TCB)
○ Stores connection information
- Kernel limits number of TCB's
- If count is full, target cannot accept any new connections
DoS! - 87What are some fixes again TCP SYN flood attacks?Cookies
Use smaller TCB for half open connections - 88what is the goal of bandwidth based attacks?send high bandwidth traffic to low bandwidth target
- 89what is DDoS?Distributed denial of service
attacker uses more than one hosts to carry out an attack
more hosts = more bandwidth
hosts can be either voluntary (such as using LOIC or HOIC), or involuntary (using botnets) - 90Advantages to DDoS?more volume - higher success rate
more than one source - harder to stop
cheap - botnet hire is very cheap - 91What is a reflected DoS attack?Send a forged request to large number of computers
forged request has the targets IP address as source address, so all replies go to the target - 92What is the amplified DoS attack?Send forged requests to server running 'vulnerable' service, with src as victims IP
- responses are larger than requests, and are sent to the target
- attack volume is increased by large amount (potentially hundreds of times larger) - 93Besides Extortion, what are other motives for DoS?Business competing
Revenge
Distraction from other malicious attacks
Politics - 94how to detect DoS attacks?Look for a sudden increase in traffic
- 95How to detect whether DoS attack is DoS or DDoS?Possibly recognised by:
attack packet header info
IP address, or fragment ID and TTL fields
attack packet stream dynamics
ramp-up behaviour
slower ramp-up implies multiple attacks
spectral analysis
frequency analysis of packet trace - 96What is Backscatter?A side effect of a DoS attack using a spoofed source address
- responses are scattered throughout IP address space - 97What is Backscatter analysis?Observe backscatter in a portion of the IP address space to determine characteristics of attack and victims
- 98what is ingress filtering?A technique to prevent src address spoofing
Routers check whether the source IP is in the leaf network the packet was received from - if it isnt, its dropped - 99problems with ingress filtering?Limited deployment
If any gaps exists it limits effectiveness of existing deployment - 100What is route based filtering?A defence against src spoofing in DoS
Filter packets based on routing information from the internet Autonomous System (AS) topology
e.g. nodes know which nodes are where, so when one tries to spoof a source address, nodes know if this is a valid source address - 101What is Pushback?A defence against DoS
Look for congestion
If congestion occurs, return messages to sources - 102DDoS defence challenges?Distributed response required
Economic and social factors
Lack of detailed attack information
Lack of defence benchmark
Difficulty or large scale testing - 103Name some proof strategies for proof of conceptCookies
Capabilities
Proof-of-work - 104Idea of DoS defence cookies?Assure, to a reasonable degree of certainty, that a client can receive a packet as its claimed source address
This is done by sending a hard-to-guess value (the cookie) to the client in response to its initial request
This makes spoofing of source address difficult - 105What is proof of computing power?Attempt to reduce DoS
attach a small cost to protocol initiation (processor time, memory, ...)
the cost is much higher for attacker then for a legitimate client
attacks are rate limited by puzzle costs - 106What is a puzzle used by Proof of Computing Power?Hashcash puzzle
- 107What are the three properties of hash functions?Onewayness
2nd premiage resistant
Collision resistant - 108What is the binding property in message digest?A message is binded if the message take out is the same as when it was committed
- 109What is a hash pointer in the block chain?A hash pointer is a pointer to where some data is stored, and a hash of that data
- 110What is the use of a hash pointer?When we have a hash pointer, we can get the data back from the previous block, and verify that it hasn't changed
- 111What is the Merkle Hash Tree?Hash tree's allow for efficient and secure verification of the contents of large data structures
each leaf node is a hash of a block, and every non-leaf node is the hash of its child nodes - 112How is the digital signature schemes used in bitcoin?(Sk, Pk) = KeyGen(keySize)
Sk = secret signing key
Pk = public verification key
Signature = Sign(Sk, msg)
isValid = Verify(Pk, msg, Signature) - 113What is the double spending attack?When someone tries to pay for something using the same bitcoin
- 114Why is Bitcoin Consensus so hard?Nodes may crash
Nodes may be malicious
Network is imperfect
- not all pairs of nodes connected
- faults in network
- latency
(no notion of a global time) - 115What is a Bitcoin Sybil attack?§ A sybil attack is an attack where a single adversary is controlling multiple nodes on a network. It is unknown to the network that the nodes are controlled by the same adversarial entity. For example an attacker can spawn up multiple computers, VM's and IP addresses. They can create multiple accounts with different user names and email addresses and pretend that they all exist in different countries
- 116Incentives to honesty in bitcoin?Block rewards
Transaction fee's - 117Proof of work properties? (Bitcoin)1. Difficult to compute
2. Parameterized cost
- nodes automatically re-calculate the target every two weeks
3. Easy to verify - 118Name some examples of how you can prove your authorisationPasswords
Secret keys
IP address
Physical location
Biometrics
Secure token - 119What is a stepping stones attack?Stepping-stone attacks are often used by network intruders to hide their identities. In a stepping-stone attack, attacking commands are sent indirectly to the victim through a chain of compromised hosts acting as "stepping stones." In defending against such attacks, it is necessary to detect stepping-stone connections at the compromised hosts. The use of encrypted connections by the attacker complicates the detection problem and the attacker's active timing perturbation and insertion of chaff make it even more challenging.
- 120How would you store a password on a server?Store the hash of the password, not the actual password
- 121How does unix store passwords?Use DES encryption as if it were a hash function
- encrypt a NULL string using password as the key
- truncates the password to 8 characters - 122What is a dictionary attack?Attacker can generate a hash for every word in the dictionary and see if the result is in the password file
- 123What is salting?Salt is a random 12 bit number used as an additional prefix to the password when hashing
- this makes the password harder to find - 124Advantages to salting?With salt, attacker must compute hashes of all dictionary words for each entry
With 12 bit random salt, same password can hash to 2^12 different hash values
Attacker must try all dictionary words for each salt value in the password file - 125What are some vulnerabilities with passwords?Keystroke loggers
- hardware
- software/spyware
Shoulder surfing
Online vs. Offline attacks
- online is much slower and easier to respond to
Multi-site authentication
- share passwords - 126Advantages to Biometrics?Nothing to remember
Passive
Cant share
With perfect accuracy, could be fairly unique - 1276 phases to hackingReconnsaissance
Scanning
Enumeration
Gaining access
Maintaining access
Clear tracks - 128What is Footprinting and Reconnaissance?The process of gathering information about an organisation
Usually without interacting with the IT infrastructure of the target organisation
Also known as Open Source Intelligence - 129What is some information an attacker can gather against an organisation in the footprinting and reconnaissance step?Info on the IT network
Info on employees
Info about the organisaton - 130What is WHOIS?created at the beginning of the internet and still used to find out who is responsible for a number of computers in the internet
- 131What info does WHOIS contain?Domain name details
Contact details of domain name admin
Range of IP addresses in domain - 132what is social engineering?The art of eliciting sensitive information and/or manipulating individuals into performing actions that may result in a security breach [… Potentially,] without the participant (or victim) even realising that they have been manipulated
- 133Vulnerabilities exploited in Social Engineering- Human nature of trust, social compliance
- Greed, pride, fear
- Lack of education / ignorance
- Lack of / weak security policies
Access control / least privileges - 134what is the purpose of social engineering?Gain information to aid attack/ expanding reconnaissance
- 135names some physical SE techniques- Tailgating
- Piggybacking
- Eavesdropping
- Shoulder surfing
- Dumpster diving
- Desk contents, e.g. sticky notes
USB stick/ CD dropping - 136name some person to person SE techniquesVishing
Impersonation
Surveys
Third-party authorisation
Reverse social engineering - 137Computer based SE techniques?Phishing/ trawling
Email, social media - 138what is spear fishing?Spear phishing is an email-spoofing attack that targets a specific organization or individual, seeking unauthorized access to sensitive information
- 139web based SE attacks?- Drive-by-download
- Credential harvesting
- Pop-ups
- Malvertisements
- Search Engine Poisoning (Spamdexing)
- Typosquatting
Watering holes - 140Some inside SE threats?- Somebody in the company already has (some level of) access. This can do a lot of damage
Examples: espionage from rival organisation, disgruntled employee out of revenge - 141What is an example of a polyaplphabetic cipher?A vignere cipher
shift cipher with different keys to different text positions
e.g. key = 'cipher'
c will shift the letter 3 positions
i will shift the letter 9 positions - 142What is a solid security definition for cryptography?Regardless of any prior information the attacker has about the plaintext, the ciphertext should leak no information about the plaintext
- 143What is the idea of perfect secrecy?Observing the ciphertext should not change the attackers knowledge about the distribution of the plaintext
- 144What is a block cipher?A block cipher is an encryption method that applies a deterministic algorithm along with a symmetric key to encrypt a block of text, rather than encrypting one bit at a time as in stream cipher
- 145What is the BLP model?Bell LaPadula
All subjects and data objects are labelled with a confidentiality level - 146What is the Simple Security Policy in Bell?A subject cannot read up
- 147What is the *-property in Bell?No write down
- 148What are the key network security concepts?Availability
Auditing
Anonymity & privacy
Channel security
Traffic analysis
Deception
Redundancy
adam and adam cant touch da ruffies - 149—
Information
- Description
- Flashcards on Security and Risk, created by Lewis Stones on 23/04/2018.
- Created by
- Lewis Stones
- Views
- 3
- Rating