Flashcards
Internet Security
Cards in this deck (13)
- 1Describe the Internet Security Threat ModelAttackers do not have access to the network.
Have to try and obtain data
e.g. Security compromises, educated guesses - 2What are cookies?Text files which provide persistence when web browsing
- 3Give 4 types of cookies1. Session
2. Persistent
3. HTTPS
4. HTTPOnly - 4How can cookies track users?Websites contain links to third-party sites. Cookie sent to third-party each time.
Build information on a user over time - 5Give 2 vulnerabilities of cookies1. Often contain SIDs to keep users logged on
2. Cookie stealing to hijack session:
HTTP (Monitoring/Sniffing),
HTTPS (XSS, DNS Poisoning) - 6What are the 2 layers of TLS?1. Record Layer: Encrypts payloads
2. Handshake Layer: Exchange session keys, authentication either party - 7What are the 4 steps of the TLS Handshake?1. ClientHello
2. ServerHello, ServerCert, ServerKeyExchange
3. ClientKeyExchange, ClientCipherSpec, ClientFinish
4. ServerCipherSpec, ServerFinish - 8Discuss TLS VulnerabilitiesPublic-key authentication protects M.I.T.M attacks.
Vulnerabilities:
1. Implementation (e.g. Heartbleed)
2. Protocol Downgrade Attack: Force weak cipher suite - 9What is XSS?Cross-site Scripting. Injecting JS into HTML.
- 10What are the 2 types of XSS?1. Reflected: Malicious URLs, trick users
2. Persistent: User input e.g. blogs, forums, shopping reviews - 11How can XSS be prevented?Santising user inputs i.e. escaping HTML tags
- 12What is XSRF?Cross-site Request Forgery.
Takes advantage of pre-authenticated (e.g. SID cookie) users through malicious URLs which execute actions on their behalf. Possible with GET or POST (via forms) - 13How can XSRF be prevented?1. Fix XSS vulnerabilities
2. Prevent POST XSRF through synchroniser tokens (one-time token submitted with forms)
Information
- Description
- Bachelors Degree Computer Science (Computer Security) Flashcards on Internet Security, created by Alex Neves on 25/05/2016.
- Created by
- Alex Neves
- Views
- 4
- Tags
- Rating