3.5 Attacks and Exploits

Question 1

What is patching fragmentation?

Answer 1

Patching fragmentation is when device updates are not implemented in a timely manner, leading to individuals using unsupported versions that leave the system vulnerable.

Question 2

Name a few issues related to mobile devices that can affect the business logic process.

Answer 2

-Lack of antimalware protection
-Using known vulnerable components
-Dependency vulnerabilities
-Insecure mobile device storage
-Passcode vulnerabilities

Question 3

What is Ettercap?

Answer 3

Ettercap is a suite of tools used to launch various types of MITM attacks.

Question 4

What is Android SDK tools?

Answer 4

Android SDK tools have packages so you can design, build and test mobile apps for Android devices along with reverse engineering an existing device.

Question 5

What is the Mobile Security Framework (MobSF)?

Answer 5

The MobSF can provide an automated evaluation of code and malware analysis using both static and dynamic analysis. It conducts a thorough assessment to determine parameters such as OS reputation, whether it has been rooted or jail broken and app security.

Question 6

What is Frida?

Answer 6

Frida is an open-source tool that can work with a wide range of OS’s. It includes custom developer tools that can help with application PenTesting, as well as many other features, such as:
-Dumping process memory
-In-process fuzzing
-Anti-jailbreak detection
-Changing a program’s behavior

Question 7

What is Objection?

Answer 7

Objection is a runtime exploration toolkit that works on iOS devices. It’s a scriptable debugger that allows you to perform various security related tasks on unencrypted iOS applications.

Question 8

How can the tools Frida and Objection work together?

Answer 8

With Objection, the team can run custom Frida scripts and interact with the filesystems on non-jailbroken iOS devices. It uses Frida to inject objects into an application and then monitors the behavior. It can also simulate jailbroken environments.

Question 9

What is Drozer?

Answer 9

Drozer is an open-source attack framework that allows you to find security flaws in the app and devices. It works as a client-server model and lets you assume the role of an Android app so you can observe the behavior of the app as it interacts with other apps.

Question 10

What is APKX?

Answer 10

APKX tool is an Android APK decompiler that allows you to pull and analyze the Java source code to see what’s going on inside.

Question 11

What is APK Studio?

Answer 11

APK Studio is an integrated development environment (IDE) designed so you can decompile or edit an APK file.

Question 12

What is Postman?

Answer 12

Postman provides an interactive and automatic environment used to interact and test an HTTP API. It contains features, such as:
-Explore and create an API
-Build and run a test suite
-Work with other team members
-Analyze results and run reports
-Integrate within the DevOps life cycle

Question 13

What are some common IoT vulnerabilities?

Answer 13

-Insecure default credentials
-Lack of physical security
-Hard-coded configurations
-Outdated firmware/hardware
-Poorly designed code
-Data leakage

Question 14

What are some attacks to Constrained Application Protocol (CoAP)?

Answer 14

-Coercive parsing attack - exhausting system resource by sending a Simple Object Access Protocol (SOAP) message with open tags
-Spoofing - possible because UDP does not use a handshake
-Packet Amplification - sending a flood of UDP packets to a DNS server with the source IP set as the victim

Question 15

What are some attacks to Message Queuing Telemetry Transport (MQTT)?

Answer 15

-Sniffing - possible because data is not encrypted
-Data modification - obtaining the traffic while data is being transferred between devices during a MITM attack
-Joining a botnet - with Shodan, it’s possible to poison unsecured devices so they become part of a botnet

Question 16

What are some common vulnerabilities to storage systems or Industrial control Systems (ICS)?

Answer 16

-Default/Blank username and password
-Misconfigured Intelligent Platform Management Interface (IPMI)
-Error messages with too much detail

Question 17

How can you test for software misconfigurations?

Answer 17

By fuzzing the system, which sends a running application random and unusual input and monitor how the app responds. A fuzzer can test config files, source code files, logs, archives, document and web files etc.
Another approach is feedback-based fuzzing, which is more interactive and can identify SQL-injection vulnerabilities.

Question 18

What are the 3 types of attack classes on virtual environments?

Answer 18

Class 1 - The attack happens outside of the VM
Class 2 - The attack directly affects a VM
Class 3 - The attack originates within the VM and is the attack source

Question 19

What is a VM Escape?

Answer 19

A VM Escape is an attack where malware running in a VM is able to interact directly with the hypervisor or host kernel. For this attack to take place, the malicious actor must detect the presence of a virtualized environment. The next step in is for the attacker to compromise the hypervisor.

Question 20

What is Hyperjacking?

Answer 20

Hyperjacking is when a malicious actor takes control of the hypervisor that manages a virtual environment. As a result, they will have all the required privileges and can take full control of the environment. In addition they will be able to access every VM along with the data stored on them.

Question 21

What is the Single Quote Method?

Answer 21

The single quote method is the simplest and most common way to identify possible SQLi vulnerabilities. It works by submitting a single apostrophe in a web app and then looking for errors.

Question 22

What is Certificate Pinning?

Answer 22

Certificate Pinning is the process of assigning a specific certificate to a particular element to avoid MITM-attacks. It usually refers to, for example. assigning a particular certificate public key in order to connect to a website securely and if a different one is provided, it will get rejected without any further checks.