Professor Mike Meyers Flashcards

Question

In an enterprize WLAN, how is it ensured that no unauthorized AP connect to your network?

Answer 1

Every AP and WLC must also authenticate each other with digital certificates. An x.509 certificate is preinstalled in each device when it is purchased. By using certificates behind the scenes, every device is properly authenticated before becoming part of the wireless network. This process helps assure that one one add an an authorized AP to your network.

Answer 2

By default, they act as web browsers. So we type ftp://202.13.212.104

Answer 3

Yes it can. We just type ftp server_address “get” command downloads the stuff and “ put” command uploads the stuff

Answer 4

It uses port number 143

Answer 5

The STARTTLS extension uses only one port (587) for encryption communication.

Answer 6

So when the emails were secured for the first time, they used TSL in such a way in clients that first clients connected to email servers using olds ports like SMTP 25, IMAP 143 and then it switched to secure TLS encrypted session. So attackers could monitor and see some data. Then as a solution came the STARTTLS that encrypted the email data from the beginning. It used just one port number for all protocols (IMAP, pop, SMTP) which was 465. And then STARTTLS start happening on port number 587

Answer 7

IPAM tool tracks and manage allotted IP addresses, keeping address requirement available for server and VM farms.

Answer 8

MAC - Mandatory Access Control - in this one, the actual resource was labeled like too secret, and based on this label we had access to it or not. These is a oldy thing. Then cane the this one - DAC - Discretionary Access Control - in this one, resources were given tags like this one is owner of this file and this can only read file. Better than MAC THEN -> Role-Based Access Control - RBAC - in this one, permissions are given to groups like Sales, or accounting group (based on the role)

Answer 9

RADIUS - Remote authentication dial-in user service RADIUS Supplicant——-R client——R server RADIUS client cane be a wireless router but not the actual device that provides user name / password or some other means of authentication. It’s not necessary for RADIUS server to have all the user name / password database. Fot example - in a enterprise environment, it can check the user name password with the database in ACTIVE DIRECTORY It uses UDP Connection

Answer 10

It provides authentication service in Local Area Networks.

Answer 11

Kerberos is setup in windows server who can act as a KDC - key distribution centre KDC consists of 2 services - 1st is authentication service and 2nd is TGS (Ticket granting service) Here is how it works - A client sends a hash of user name and password to the KDC / Kerberos server and KDC authenticates it and sends back a TGT (Ticket granting Ticket). Then TGT is time stamped and sent back to the server for authorization. Then a Token ( time stamped one) is sent back to the client and it kind of usually stays active of 8 hours.

Answer 12

It is a kind of authentication protocol in which server can ask client what kind of authentication client supports and then use that authentication. Different authentication methods that it can negotiate from are following- - EAP PSK ( pre shared key) - PEAP (protected extensible authentication protocol) - uses user name and password - EAP MD5 - uses hash - EAP TLS - it can use certificates in which certificates come from the server side and passed down to clients.

Answer 13

It is used in wireless networks. Kerberos dominates over wired networking authentication.

Answer 14

Active directory

Answer 15

It is used to manage multiple apps using a single account. SSOcircle provides a variety of service provider (SP) samples. In SAML concept, there is Identity provider and the service provider.

Answer 16

We use signed certificates. Like x.509 certificate.

Answer 17

It is nothing more than a hash. It is a mechanism by which we can verify that a public key came from the server that has the associated private key. So how is it verified? Let’s take an example of web server connection. So the server will encrypt the website that we are visiting/ connected to, with its private key and make a hash of it and will send it to the host with its public key. Host on the other end will also make a hash of the web page using the public key and then compare the hash it created with the hash shared by the web server. If it matches, then host knows that public key came from the server that has the associated private key.

Answer 18

Here comes the involvement of 3rd party CA who both parties trust. So let’s say i am the server. I will get an singed certificate from CA who will vouch for me. So basically in this certificate ( when is a kind of envelope), i will have my own digital signature and the CA’s signature and my public key. Every time anyone connects to me, i will pass on this certificate to them. This way i can let know hosts that i am a trustworthy site.

Answer 19

When there is no 3rd party like CA, vouching for me. They work fine internally in the local area network as no intruder has access to it.

Answer 20

It is a hierarchy of certificate authorities that issues certificates.

Answer 21

CRL and OCSP

Answer 22

It will encapsulate private addressing ( LAN IP) within internet public IP. Kind of it creates a Tunnel. Note - it may not be encrypted.

Answer 23

It links switch-ports to increase bandwidth. Uses LACP (Link Aggregation Control Protocol)

Answer 24

Monitor session 1 source int fa24 monitor session 1 destination int fa23

Answer 25

Firewall - filters traffic IDS - monitors traffic and notifies IPS - acts to stop

Answer 26

It connects on the client side and hides them. So clients are aware of the proxies. It can act as a dedicated box or a software. - provides caching - provides content filtering - acts as Firewall Also note - proxies are application-specific. Depending on the type of application, there are different types of proxies. - web proxy - FTP proxy - VoIP proxy

Answer 27

With TOR network concept, a client can hide themselves so that they are not trackable back to them. So the client connection will go through bunch of computers in TOR network.

Answer 28

These proxies protects servers from evil people. - provide security protection like protection from Denial of Service - provides caching - provides load balancing - handles encryption/ decryption

Answer 29

It is done using DNS. 1st way is the Round Robin via DNS. Let’s say we have 3 server that needs to be load balanced. In their authoritative DNS SERVER, we will have 3 look up records to these 3 servers and as the the connection requests come in, this DNS server will give the address of the 1st server and then 2nd and so on. 2nd way is in which DNS uses reverse look up zones. By using reverse look up zone, DNS will find out which server is closest to it ( as the servers can be in different continents) and then provides its IP ADDRESS for connection.

Answer 30

These are physically present on the site. It can query the individual servers and can know which is not busy. - can also provide encryption/ decryption yet

Answer 31

Demilitarized zone. DMZs are used to protect public-facing servers by creating an isolated area for those devices. 2 firewalls are used in a DMZ : one allowing unsolicited traffic to the public service and the 2nd maintaining isolation of the private network.

Answer 32

Volumetric attacks - it can be a continuous PING flood. Application attacks - one that are attacked at a particular application. For example - Slow Loris attack that happens in Apache server. Protocol attacks - one that is for a particular protocol. For example- SYN flood / TCP SYN attack.

Answer 33

Smurf attack - in this one, attacker will spoof the Ip address of its target and will send a IP broadcast in the network so that it make the server to receive frames from all the nodes in that network.

Answer 34

In this attack, a bunch of computers attack a single target. The attacker loads some type of malware called botnet, into the other devices called Zombie devices, and make them contact the target machine in some way.

Answer 35

A virus is something that will get on to our computers from floppy drive or thumb drive and attach it to the OS files. What does it do? I will propagate to the connected devices and it will activate. ( for example, it might delete the OS FILES)

Answer 36

It is a type of Malware which will pop up ads on some website.

Answer 37

It is a type of malware.l which hides itself from the system and will phone home in some way. It might be sending monitored data or might be sending cookies etc

Answer 38

It is a piece of software that will not propagate on its own. For example- Remote access Trojans (RATs) - It doesn’t do anything until someone from home connects to this Trojan malware and bad things start happening.

Answer 39

In its basic form, it encrypts someone’s data and will ask for ransom to decrypt it

Answer 40

It is kind of similar to Trojan in the way that it does not propagate and needs to be activated. Though its not like it is remotely accessed and then activated. It gets activated when some event take place. For example - when some account is deactivated.

Answer 41

Rootkit is a software that escalates privileges to execute other things on a computer. For example- Sony rootkit These are notorious to detect. Backdoor -it is a piece of software that will let someone to intentionally access some software from some backdoor.

Answer 42

It can be armored virus, polymorphic ( it changes some of its code ) It can also be a keylogger to get passwords etc.

Answer 43

Stateless fireless - we just turn them on without much configuration. Stateful- it will look at every packet and will decide whether it should let it go or not. It involves a lot of configuration. Stateful firewall make a database of all active connections that are going between a client and the server. Some some packet is a part of active connection, firewall does not compare this packet with each ACLs. It just allows in the packet as it is a part of the active connection.

Answer 44

Ettercap - it can act as a spoofer. It can also grab the data from the network and provide us the information that we want. Ettercap creates a lot of noise on the network that is easily detected by an good IDS / IPS. We can do DHCP SPOOFING, ARP spoofing, DNS poisoning etc all from a single program.

Answer 45

Url highjaking or Typosquatting Domain Highjacking -when someone forgets to renew their lease of public domain and someone else buys it. Replay attacks - Downgrade attack - in which encryption is lowered. Session highjacking - it is quite difficult as it has to be done in real time. There is simple one as well - Firesheep

Answer 46

These are the ones who acts as a lot of things like firewall, proxy server, VPN endpoint, etc

Answer 47

It filters packets based on ports and IP Addresses. It does not look at the data deep enough. So it does not track the state of conversations.

Answer 48

These are also known as context-and application- aware firewalls that filter traffic based on the content of the packets. These does the deep packet inspection (DPI)

Answer 49

Creating user accounts, change the default ADMIN user name / password Assigning right based on roles, Update the firmware of devices like camera, switches Stop the traffic on open ports that are not used Shut down the physical ports that are not used. Do the key / signature / certificate management on devices so we can do an back up of them We can do the vulnerability assessment in which we have some level of access to the network Going to next level, we can also ask someone to do the penetration testing

Answer 50

Deterrent, Preventative, Detective Learn to identify what falls under all of these types and how to improve these physical controls.

Answer 51

We look for unwanted open ports. Ports can be opened by a installed new software, firmware update on the router, or by mistake while doing some configuration on the managed devices.

Answer 52

These applications can look for vulnerabilities in our network. For example - it can look for the open ports in our network or it can also show us the services running on some particular server or can show us the network topology and can find us the devices that we didn’t know of. Example - NESUS and NMAP ( it is free and i will play with this)

Answer 53

These are the applications that can mimic some server so they pretend to be some server for baiting for attackers so that we can monitor the attackers activity. There are some free ones as well.

Answer 54

Look for blocked TCP / UDP ports

Answer 55

Authentication, encryption, MIC - Message integrity check

Answer 56

It can involve a number of authentication protocols to be used for authentication. While using it, one can use an authenticated protocol from a number of protocols. EAP can integrate with this 802.1x standard. It involves Supplicant, Authenticator, authentication server (AS)

Answer 57

1. LEAP - light weight extensible authentication protocol- NO LONGER USED 2. EAP - FAST (flexible authentication by secure Tunneling 3. PEAP - Protected Extensible Authentication protocol- in this one, AS ( authentication server) authenticates itself to the supplicant using a certificate. Once authenticated, a TLS TUNNEL is created between Supplicant and AS. And then client / supplicant is authenticated through the TLS TUNNEL. For client authentication, it can either use MSCHAPv2 or GTC ( generic token card) 4. EAP - TLS

Answer 58

1. TKIP - Temporal key Integrity Protocol - no longer used 2. CCMP - it uses AES ENCRYPTION and one MIC. Used in WPA2 3. GCMP - uses AES. And for MIC - it uses Galois Message authentication code (GMAC) used as a message integrity check. Used in WPA3

Answer 59

WPA - uses 802.1x authentication, TKIP WPA2 - uses AES CCMP Algorithms WPA3 - uses AES with GCMP All WPAs support 2 client authentication modes : a pre-shared key or 802.1x based on the scale of deployment. These are known as personal mode and enterprise mode

Answer 60

It is a Denial Of Service Attack. In this attack, a large number of Ping responses are sent to a victims address which results in Victim host being unresponsive, hanging

Answer 61

The attack happens like this - 1. The attacker will send a TCP message acting as a destination host to a target host. 2. While the target hosts response is on its way, the attacker will send a route redirect message spoofing a primary gateway, to the target host. 3. This way, the target host will change its gateway from primary to secondary that is under attackers control. 4. From this point on, attacker will be man-in-the-middle. All the traffic from target host will start travelling from the secondary host where attacker can see all the data

Answer 62

In DDOS, the attack on a particular host comes from different source hosts. In DDOS, the attacker deploys Bots that are malicious programs, on different computers. Then the attacker will control them using Command And Control server. Example of such attack is Denial of Service using DNS and NTP

Answer 63

One example of Permanent Denial Of service is PDoS - Phlashing Denial of Service. In PDoS, the victim devices firmware is damaged / corrupted in such a way that device can't be repaired. I will need to be replaced.

Answer 64

In Smurf attack, the attacked will spoof victims IP address and will send a broadcast ping in the network. Doing so causes the every host in the network to flood victim host with ICMP ping replies.

Answer 65

In SYN flood attack, the attacker will send multiple SYN request to an server which will cause the server to reserve some storage in its memory for the new connection until server memory is fully exhausted with these SYN requests. At this point, the server can't take any more requests (even that are legitimate ones)

Answer 66

DoS attacks using DNS -> in this one, attacker deploys Bots and attacker make these bots to spoof the IP address of victim and send some small 8 byte DNS request to DNS servers. Doing so cause the DNS servers to flood large amount of information to the victim address DoS attack using NTP -> in this one, the attacker spoofs the IP address of target and sends "monlist" command to NTP servers. Doing so cause the NTP servers to reply to target with information of last 600 hosts who have contacted the NTP server. It only occurred in old version of NTP servers

Answer 67

It is a kind of Man-In-The-Middle attack. In this one, ARP cache on the switch is poisoned and traffic starts travelling through the attacker device.

Answer 68

Protocol abuse is done on those applications that are used almost in every network. For example - DNS and ICMP One example of DNS protocol abuse - Let's say that the attacker managed to get inside the network and has again admin rights as well. To maintain such access for the later time, attacker has 2 options First is he/she can install a backdoor on the victim device but most of the time outgoing or incoming traffic on an unknown port is block by the Firewalls so he/she can go for the 2nd option. 2nd option is that attacker can abuse DNS. So on the victim device, it will install a iodine application which will encapsulate the traffic that attacker want inside DNS packets and these DNS packets will be allowed to travel through the Firewall. On the other end of this DNS-Iodine connection, the recipient will also have Iodine app installed which will de-encapsulate the traffic and will forward it to the attacker.

Answer 69

Spoofing is the process of faking some one's address. There is 3 kind of spoofing - 1. First is ARP spoofing 2. Email spoofing - in this one, the From field is changed to hide the sender email address 3. Referrer header spoofing - in this one, the attacker will spoof the Referral header of HTTP packet in a connection request to a server so that It will show such a referral header / page from which access to this server is allowed.

Answer 70

Sessions hijacking is the process in which attacker will taker over a session with a server once the client has authenticated to the server There is 3 types of Session Hijacking - 1. Session fixation - in this one, the attacker will send a link to victim with session ID pre-set. So once the target establishes session with the server , the attacker takes over the session 2. Session sidejacking - in this one, the attacker will sniff the packets to get the session cookie or if the attacker has access to the client device, it can try to get the session cookies from its memory. 3. Cross Site scripting - In this one, the attacker will put a malware on the victim device with which it can run some code on the site to steal cookies. This happens after the client has authenticated to the server.

Answer 71

In VLAN hopping, the frames passing through a switch are double tagged with 802.1Q headers. It is done so that frame enters a VLAN that it is not part of.

Answer 72

Virus is a malware type that is activated with user action. For example- opening a infected executable file.

Professor Mike Meyers Flashcards

(99 cards)