Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Certified Ethical Hacker > Mobile Comms and IOT > Flashcards

Mobile Comms and IOT Flashcards

(54 cards)

Start Studying
1
Q

Bring Your Own Device (BYOD)

A

Allowing employees to use a personal phone for company business and to store company data on the phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Smartphone attacks

A
  1. Attack the device: Browser attack, phishing, SMS, rooting and jailbreaking
  2. Network attack: DNS cache poisoning, rogue access points, packet sniffing
  3. Data center or cloud attack:
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OWASP Top Ten for Mobile

A 
M1: Improper Platform Usage
M2: Insecure Data Storage
M3: Insecure Communication
M4: Insecure Authentication
M5: Insufficient Cryptography
M6: Insecure Authorization
M7: Client Code Quality
M8: Code Tampering
M9: Reverse Engineering
M10: Extraneous Functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

M1: Improper Platform Usage

A

Android intents,
platform permissions,
misuse of TouchID, the Keychain or other security control that is part of the mobile operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

M2: Insecure Data Storage

A

Insecure data storage and unintended data leakage,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

M3: Insecure Communication

A 
Poor handshaking, 
incorrect SSL versions, 
weak negotiations, 
clear-text communication of sensitive assets, 
insecure communications channels.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

M4: Insecure Authentication

A

Failing to identify the user, failure to maintain user’s identity and weakness in session management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

M5: Insufficient Cryptography

A

Anything and everything related to TLS or SSL but not if cryptography is not employed which is M2. This is attempting to use cryptography just not correctly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

M6: Insecure Authorization

A

Failures to properly authorize a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

M7: Client Code Quality

A

Code level implementations in the mobile client like buffer overflows,
format string vulnerabilities, and
various other code level mistakes where the solution is to rewrite (patch) the code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

M8: Code Tampering

A 
Binary patching, 
local resource modification, 
method hooking, 
method swizzling, and 
dynamic memory modification.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

M9: Reverse Engineering

A

Analysis of binaries to determine its source code, libraries, algorithms, and other assets. Tools like IDA Pro, Hopper, otool are binary inspection tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

M10: Extraneous Functionality

A

Build in a backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Rooting and jailbreaking

A 
Modifying a mobile OS to gain root access to the device. 
Rooting Android tools: 
KingoRoot, 
TunesGo, 
OneClickRoot, 
MTKDroid

Jailbreaking IOS tools: 
evasi0n7, 
GeekSn0w, 
Pangu, 
Redsn0w, 
Absinthe, 
Cydia
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Three Techniques of Jailbreaking IOS

A
  1. Untethered jailbreaking: The kernel will remain patched (jailbroken) after reboot, with or without a system connection
  2. Semi-tethered jailbreaking: a reboot no longer retains the patched kernel but the software resides and can be applied again when needed
  3. Tethered jailbreaking: A reboot removes all jailbreaking patches and the phone may get stuck in a perpetual loop at startup requiring a USB system connection to repair.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Three types of Jailbreaking IOS

A
  1. Userland exploit: Cannot be tethered and can be patched by Apple. Provides user-level access but not Admin. Equates to OS level
  2. iBoot exploit: vulnerability found in the device’s bootloader. iBoot to turn codesign off and run a program. iBoot can be semi-tethered and patched by Apple
  3. BootROM exploit - Allows access to the file system, iBoot, and custom boot logos and is found in the device’s first bootloader, SecureROM. This can be untethered and cannot be patched by Apple. The bootrom exploit is the lowest level and the only way apple can “fix” this is by releasing new hardware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Android Device Administration API

A

Provides system-level device administration to create security-aware apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Mobile Device Management - MDM

A

Can push security policies, applications, and monitor device, passcodes for device unlocking, remote locking, remote wipe, root or jailbreak detection, policy enforcement, inventory and monitoring. Solutions: XenMobile,
IBM MaaS360,
AirWatch,
MobiControl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Bluetooth

A

Open wireless technology for data exchange over short range (10 meters or less). Easy to discover and hack. Has two modes, Discovery Mode and Pairing Mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bluetooth Discovery Mode

A

Determines how the device reacts to inquiries from other devices looking to connect. Has three actions:

  1. Discoverable - respond to all queries
  2. Limited Discoverable - restrict who can query
  3. Nondiscoverable - ignores all queries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Bluetooth Pairing Mode

A

Tells the device how to react when another Bluetooth system asks to pair with it.

  1. Pairable
  2. Nonpairable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Mobile Attacks

Study These Flashcards
A

SMS Phishing
Trojans: Android: Obad, Fakedefender, TRAMPA, ZitMo
Spyware: Mobile Spy, Spyera
Tracking: AndroidLost, FindMyIphone,WheresMyDroid

23
Q

Stagefright

Study These Flashcards
A

Software bugs affecting Android operating systems to perform remote code execution and privilege escalation

24
Q

Mobile Device as an attack platform

Study These Flashcards
A

Network Spoofer

DroidSheep - perform sidejacking by listening to wireless packets and pulling session IDs

25
NetCut
You can identify all systems on your current WiFi and cut them off with the click of a button
26
Bluetooth attacks
1. Bluesmacking - denial of service attack 2. Bluejacking - sending unsolicited messages to and from mobile devices 3. Bluesniffing - discover bluetooth devices (like war driving) 4. BlueBugging - successfully access a bluetooth device and remotely use its features 5. Bluesnarfing - theft of data from a mobile device due to an open connection 6. Blueprinting - footprinting for Bluetooth
27
Bluetooth attack tools
``` Bluescanner - locates bluetooth devices BtBrowser - locate and enumerate Bluesniff btCrawler Bloover - good for bluebugging Phonesnoop - spyware Super Bluetooth Hack - all in one software for hacking bluetooth ```
28
Internet of Things - wearables
Array of smart watches and other items worn by a user that are internet accessible
29
IOT
A network of everyday objects with IP addresses that have the capability of sensing, collecting, and sending data to each other made possible by machine to machine communication, large availability of storage and inter networked communication.
30
IOT Components
1. Sensing Technology 2. IOT Gateways 3. Cloud
31
IOT Operating Systems
Riot OS - embedded systems, actuator boards, sensors, energy efficient and uses minimal resources ARM mbed OS - low powered wearable devices RealSense OS X - cameras, Intel's depth sensing version Nucleus RTOS - used in Aerospace, medical and industrial applications Brillo - Android based OS normally found in thermostats Contiki - made for low powered devices found in street lighting and sound monitoring Zephyr - low power devices Ubuntu Core - used in robots, drones - also known as snappy Integrity OS - found in aerospace, medical, defense, industrial and automotive sectors Apache Mynewt - devices using Bluetooth Low Energy protocol
32
IOT Communications models
1. Device to Device 2. Device to Gateway (before sending to cloud) 3. Device to Cloud 4. Back-end data sharing
33
Vehicle Ad Hoc Network (VANET)
Used by vehicles and the creation of a spontaneous creation of a wireless network for vehicle-to-vehicle (V2V) data exchange
34
IOT Architecture Layers
Edge Technology Layer - sensors, RFID tags, readers and devices Access Gateway Layer - First data handling, message identification and routing Internet Layer - main component for all communication Middleware Layer - handles data and device management, data analysis and aggregation Application Layer - delivery of services and data to the user
35
OWASP - Top ten IOT vulnerabilities and attacks
I1: Insecure Web Interface I2: Insufficient authentication/authorization I3: Insecure Network Services I4: Lack of transport encryption/integrity verification I5: Privacy Concern I6: Insecure Cloud Interface I7: Insecure Mobile Interface I8: Insufficient Security Configurability I9: Insecure Software/Firmware I10: Poor Physical Security
36
Attacks against IOT
``` Distributed Denial of Service (DDOS) Sybil Attack Rolling Code attack Ransomware Man in the middile Side Channel Malware ```
37
Sybil Attack
is an attack wherein a reputation system is subverted by forging identities in peer-to-peer networks.In a Sybil attack, the attacker subverts the reputation system of a peer-to-peer network by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence. A reputation system's vulnerability to a Sybil attack depends on how cheaply identities can be generated, the degree to which the reputation system accepts inputs from entities that do not have a chain of trust linking them to a trusted entity, and whether the reputation system treats all entities identically. Multiple forged identities are used to create the illusion of traffic congestion that affects everyone else in the local IOT network.
38
Rolling Code attack also called a hopping code
The code used by a car key fob is called a rolling code. An attack can sniff for the first part of the code, jam the key fob, and sniff the second part, allowing the attacker to steal the code and the car. Tool: HackRF
39
Blueborne Attack
An amalgamation of techniques against known, already existing Bluetooth vulnerabilities
40
IOT Hacking Methodology
``` Information gathering, vulnerability scanning, launching attacks, gaining access and maintaining access ```
41
IOT Search Engine
Shodan
42
Vulnerability scanners and assessment tools for IOT
``` NMAP RIoT Vulnerability Scanner beSTORM IoTSploit IoTInspector Nessus ```
43
Attacking IOT tools
``` Firmalyzer KillerBee JTAGulator Attify Zigbee Framework Telnet ```
44
IOT Sniffers
Foren6 Z-wave Cloudshark
45
OWASP I1: Insecure Web Interface
Account enumeration, lack of account lockout and weak credentials present
46
OWASP I2: Insufficient Authentication/Authorization
Weak passwords
47
OWASP I3: Insecure Network Services
Susceptible to buffer overflow attacks or create denial of service opportunities
48
OWASP I4: Lack of Transport Encryption/Integrity Verification
Allows data to be viewed as it travels over local networks or the Internet
49
OWASP I5: Privacy Concern
Collection of personal data without proper protection
50
OWASP I6: Insecure Cloud Interface
When easy to guess credentials are used or account enumeration is possible
51
OWASP I7: Insecure Mobile Interface
When easy to guess credentials are used or account enumeration is possible
52
OWASP I8: Insufficient Security Configurability
When users of the device have limited or no ability to alter its security controls
53
OWASP I9: Insecure Software/Firmware
Lack of the ability to be updated
54
OWASP I10: Poor Physical Security
When an attacker can disassemble a device to easily access the storage medium

Certified Ethical Hacker (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions