Module 24 Technologies and Protocols Flashcards
What port does Syslog servers utilize?
UDP 514
Why are NTP and Syslog important?
Syslog is the standard for logging user event messages. Time is just fucking important
Why is attacking a syslog server important, from the perspective of an attacker?
Some exploits involve data exfiltration, which takes time. Hackers may attempt to block or destroy log data - in order for Hackers to hide the fact, that exfiltrating is occurring.
What port does NTP use?
UDP 123
How about DNS?
DNS is now used by malware, some varieties of malware use DNS to communicate with command-and-control (CnC) servers and to exfiltrate data in traffic disguised as DNS queries.
Why is HTTP a risk?
All the information carried in HTTP is transmitted in plaintext.
What is an iFrame (inline injection) attack
Threat actor compromises a web server and plants malicious code which creates an iFrame on a visited webpage. When the iFrame loads, malware is downloaded.
What prevents an iFrame?
Cisco Web Reputation filtering can detect when a website attempts to send content from an untrusted website to the host.
What does HTTPS use that is helpful?
After application layer (SSL/TLS) before transport, as the header trailer for the PDU is built
What problems does HTTPS present?
Because it is encrypted with SSL - not all devices included decryption and inspection. Privacy issues in opening the traffic.
Explain the HTTPS transaction
Client request secure page. Web server sends its public key with its certificate. Client ensures the certificate is up to date, issues by a trusted party and creates a symmetric key which goes to the server. Server decrypts the symmetric key with its private key. Web server THEN uses the symmetric key to encrypt the page and sends it to the client. BOOM
Are email protocols dangerous?
SMTP, POP3 and IMAP can be used to spread malware, exfiltrate data or provide channels to CnC servers.
How does IMAP and POP3 spread malware?
They are used to download email messages from a mail server to a host.
What can ACL’s prevent?
ICMP Abuse, this is interesting, you allow responses (ICMP unreachable, ICMP replies but deny other responses from ICMP)
What is the downside with ACLs?
Attackers can determine which IP addresses, protocols and ports are allowed by the ACLs, and spoof a source IP.
