pain points module 4: cryptographic attacks

Question 1

BIRTHDAY ATTACK

1) what is attacker trying to gain
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 1

1) trying to trick a system by producing a hash collision, possibly tring to fake a signature or match a digital fingerprint. Faster than brute force.

2) core exploit: mathematical probability that 2 different inputs can generate the same hash in weak hashing algorithms. based on birthday paradox (you only need 23 people in the room for a 50% chance that 2 people will have the same bday)

3) mitigation: use strong, collision-resistant hash functions

Question 2

What is credential stuffing?

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 2

1) gain unauthorized access to accounts by reusing known leaked credentials.

2) user behavior: password reuse across different sites/services

3) Mitigate: MFA, monitor login anomalies, credential monitoring (eg haveibeenpwned.com)

Question 3

Password spraying

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 3

1) unauthorized access to user accounts

2) 1 password → many users (same system). bypass lockouts by trying a few known passwords for many accounts on the same system, not brute-forcing one user.

3) enforce account lockouts after a low number of tries; require strong passwords; monitor for multiple login attempts across many accts

Question 4

Known plaintext attack

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 4

1) learn key or encryption method by analyzing known plaintext + ciphertext

2) attacker’s access to both encrypted and unencrypted message and studies patterns. They may reverse-engineer the key, the algorithm behavior, or implementation flaws, allowing them to decrypt future messages

3) modern, strong encryption algos; don’t reuse keys; padding & initialization vectors

Question 5

What’s the difference between hashing and encryption?

Answer 5

Hashing is one-way: input → hash. It’s used to verify integrity (e.g., password checks).
Encryption is two-way: plaintext ↔ ciphertext. You need a key to decrypt and read the message.

Question 6

COLLISION ATTACK

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 6

1) goal: find 2 different inputs that produce the same hash value, then use whatever files collide to shape the nature of your attack

2) exploits weak hash functions by generating two different inputs that produce the same hash output. This can let attackers substitute malicious files or bypass identity checks.

3) use strong hash functions; avoid using hashes for sensitive data without digital signatures

Question 7

TYPES OF ATTACKS MNEMONIC

Question 8

ARP POISONING

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 8

address resolution protocol (arp)

1) goal: become a man-in-the-middle to intercept or manipulate network traffic on a LAN

2) core exploit: ARP doesn’t authenticate, it’s trust-based. anyoe can claim to be any IP/MAC

3) use dynamic arp inspection (DAI) on switches; implement static arp tables on critical systems; use VPNs or encrypted protocols to protect data in transit

Question 9

RAINBOW TABLE

Answer 9

1) goal: crack a hashed password using precomputed hash values

2) core explit: hashes generated without salt can be reversed by matching to a table

3) strong hash algos + SALTING + strong passwords

Question 10

TLS

Answer 10

transport layer security
- modern version of SSL
- provides encryption, data integrity

Question 11

DNS

Answer 11

Domain name system

Question 12

DNS server

Answer 12

a computer that responds to domain lookups

Question 13

MAC address

Answer 13

Meda Access Control address
- unique hardware address burned into your computer’s NIC (network interface card)
- for devices on a LAN

Question 14

NIC

Answer 14

network interface card

Question 15

what is the global body that controls domains?

Answer 15

ICANN

Question 16

what is cache?

Answer 16

temporary storage for data you’ve already used – so you can access it faster next time. faster and more specialized than ram.

Question 17

explain DNS poisoning

Answer 17

• attacker trying to gain access to web traffic and credentials
• done by redirecting victim to a malicious site that looks leigit
• can also damage reputation

Question 18

explain ARP poisoning

Answer 18

• attacker trying to gain access to local network traffic.
• they trick other devices into thinking their device is the router or another host

Question 19

what happens when you click a url? (6 steps)

Answer 19

1. Your browser asks itself: do i already know the IP for this domain?
2. Recursive resolver (your ISP or public eg Google) asks root DNS server (managed by ICANN, etc): “who has the IP for tythedoghouseguy.com?”
3. Root DNS server asks itself/TLD server: ‘where are .com domains managed?” sends answer to recursive resolver

4.TLD server asks itself/authoritative DNS “where is the DNS for this domain?” sends answer to recursive resolver

5. Authoritative DNS Server (eg namecheap, cloudflare) asks itself (lookup zone file): “what’s the IP for tythedoghouseguy.com?” sends answer to recursive resolver
6. recursive resolver sends answer to your browser. browser now asks web server: “can i get the webpage for / or /shop for this IP?” web server returns it

Question 20

explain TLD

Answer 20

top-level domain

Question 21

what is a recursive resolver

Answer 21

• a DNS server running DNS software
• job is to keep asking questions on your behalf until it gets a final answer, then send it back to your browser

1. ask root server -> get referral to .com
2. ask .com server -> get referral to DNS
3. ask authoritative DNS -> get actual IP address
4. return answer to your browser

Question 22

DOS attack

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 22

denial-of-service

1) attacker’s goal: make system/service unavailable to legit users

2) core exploit: overwhelm’s server’s finite resources (CPU, memory, bandwidth, ports) w junk traffic or malicious requests

2.5 ) how it works: sends a flood of requests so server spends all its time responding to junk and can’t serve real users

3) how to mitigate: rate limiting; web app firewalls (waf) intrustion prevention systems (ips), moitoring for unusual traffic

Question 23

SLOWLORIS ATTACK

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 23

1) goal: tie up web server’s available connections to block real users

2) core exploit: exploits how HTTP servers keep connections open waiting for full requests

2.5) how it works: sends incomplete HTTP requests, drip-feeding them slowly. server holds each connection open, thinking more data is coming….until it hits the limit of simultaneous connections

3) mitigate: timeout settings for HTTP headers/body; max concurrent connections per IP; reverse proxies/load balancer software

Question 24

DDOS ATTACK

1) attacker’s goal
2) core exploit/how it works
3) how to mitigate/protect from it

Answer 24

distributed denial of service

1) goal: take down a service by overwhelming it with massive amounts of traffic from many sources

2) core exploit: volume and distribution – uses a botnet to send coordinated traffic attacks

2.5) how it works: many zombie computers flood a target with junk traffic. hard to block without also affecting real users bc it comes from everywhere

3) mitigation: cloud-based DDOS protection; geo0blocking or IP reputation filtering; traffic anomaly detection and blackholing

Question 25

AMPLIFICATION ATTACK 1) attacker's goal 2) core exploit/how it works 3) how to mitigate/protect from it

Answer 25

1) goal: overwhelm a target server by bouncing huge response traffic off other servers 2) core exploit: UPD-based services that reply with more data than they receive (DNS, NTP) 2.5) how it works: attacker sends a small query to a public DNS server, spoofing victim IP. DNS server replies w much larger response -- sent to victim. repeat thousands of times-- massive data flood 3) mitigation: block IP spoofing w. filters; disable or rate-limit public UPD svcs; DNS response rate limiting

Question 26

BUFFER OVERFLOW 1) attacker's goal 2) core exploit/how it works 3) how to mitigate/protect from it

Answer 26

1) goal: inject malicious code/crash system by exceeding expected input limits 2) core exploit: programs that don't check input length properly, letting attackers overwrite adjacent memory 2.5) how it works: app expects 20 characters, attacker sends 1000. extra char.s spill into adjacent memory, and they can run code like give me admin cred.s 3) mitigate: use modern lang.s with memory protection. enable DEP and ASLR. do input validation

Question 27

PRIVILEGE ESCALATION 1) attacker's goal 2) core exploit/how it works 3) how to mitigate/protect from it

Answer 27

1) goal: gain higher permissions than they're athorized for (eg user > admin) 2) core exploit: vulnerabilities or misconfigurations in OS, software, or services 2.5) how it works: attacker is logged in; finds bug/insecure file permission. now they can ruun code as privileged user, read/write sensitive files, and change system settings

Question 28

VIRUS 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 28

1) attacker's goal: SPREAD MALICIOUS CODE BY PIGGYBACKING ONTO LEGIT FILES 2) core exploit: user trust + execution/interaction with infected files 3) how it works: attaches self to host, file. when user rns it, virus code runs too. may damage data disable functions, or drop other malware. 4) how to mitigate/protect from it: updated antivirus, disable autorun for external media, block suspicious file types (.vbs, .scr), educate users

Question 29

WORM 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 29

1) attacker's goal: AUTOMATICALLY SPREAD MALICIOUS CODE ACROSS NETWORKS AND DEVICES 2) core exploit: open network ports + vulnerable services 3) how it works: self-contained; no host file or interaction needed. sellf-replicating, and self-executing. once inside host network, scan for other vulnerable systems and SEND THEMSLEVES 4) how to mitigate/protect from it: patch systems, use firewalls, segment networks, monitor for port scanning behavior

Question 30

TROJAN 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 30

1) attacker's goal: TRICK USER INTO RUNNING MALICIOUS CODE DISGUISED AS LEGITIMATE SOFTWARE 2) core exploit: user trust in a fake application 3) how it works: looks like a useful tool/game/installer but contains malware 4) how to mitigate/protect from it: application whitelisting verify softwre sources (hashes, vendors), restrict admin privileges, user training

Question 31

BACKDOOR 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 31

1) attacker's goal: GET PERSISTENT, UNDETECTED, UNAUTHORIZED ACCESS TO A SYSTEM 2) core exploit: unprotected/forgotten access methods (dev/test code, system misconfigs) 3) how it works: could be intentional or not. added intentionallly by malware often after initial compromise to maintain access 4) how to mitigate/protect from it: scan for unauthorized network svcs, audit code for test/dev leftovers; use host-based instruction detection system HIDS

Question 32

REMOTE ACCESS TROJAN (RAT) 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 32

1) attacker's goal: TAKE FULL CONTROL OF A MACHINE REMOTELY 2) core exploit: disguised trojan and open outblound cnnection (so firewall doesnt block it) 3) how it works: trojan gives attacker: 1)command line access; 2) file system control; 3) keylogging; 4) webcam/mic spying 4) how to mitigate/protect from it: endpoint detection & response (EDR) tools

Question 33

KEYLOGGER 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 33

1) attacker's goal: steal credentials and sensitive data entered via keyboard 2) core exploit: interception of keyboard input withiut detection 3) how it works: software (background) OR hardware (usb) 4) how to mitigate/protect from it: secure input fields (eg virtual keyboards), detect unauthorized processes, hardware inspections, EDR w. behavioral dtection

Question 34

SPYWARE 1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Answer 34

1) attacker's goal 2) core exploit 3) how it works 4) how to mitigate/protect from it

Question 35

modem