- So welcome to lesson seven, deep dive quiz.
In lesson seven, we focused on explaining various types
of vulnerabilities and we had two sub lessons
seven dot one and seven dot two.
In seven one we did a vulnerability primer
and in seven two, we focused on network
and operating system and cloud vulnerabilities.
So, let's do a quiz together.
You ready?
Make sure you have a pen or a pencil and a piece of paper.
Put me on pause as often as you need to,
so that you can answer the questions.
Don't just listen to me, I want you to answer the questions
and then together we'll go through an explanation.
So let's start.
Question one.
Which of the following best describes a zero day threat?
Now, best describes is our key words here.
There's no time between when a vulnerability is known
to developers and when is exploited by adversaries.
A vulnerability that has been publicly announced,
a threat that's in the wild,
and has the potential to cause significant harm,
or denotes the day a threat was identified.
Hmm, this is a tough one,
'cause it looks like maybe there's
a couple of reasonable answers.
But really what we're trying to focus on here is,
if you were explaining what a zero day threat was
to somebody else,
which one of these explanations would help them the most?
Which one would they understand?
And that's what we mean by best describes.
So no time between a vulnerability is known
to developers and when it's exploited by adversaries,
a vulnerability that's publicly announced,
a threat that's in the wild
and has the potential to cause significant harm,
or denotes a day a threat was identified.
What are you gonna choose?
I'm gonna choose the first one.
Because I think that one best describes that
there's no time between when the vulnerability is known
to developers and when it's exploited by adversaries.
The second one, a vulnerability that's publicly announced,
it may or may not be publicly announced.
The third, a threat that's
in the wild and has a potential to cause harm.
Absolutely it does, except that that's not really
what's specific to being a zero day.
And denotes a day a threat was identified.
Not a bad explanation, but doesn't best describe it.
So I'm gonna go with the first one.
Do you like it?
All right.
And it is correct.
Let's move on to question two.
This type of disclosure balances the need to know
with harm that may be caused.
Is this ethical disclosure, responsible disclosure,
limited disclosure, or full disclosure?
Ethical, responsible, limited, or full?
What do you think?
You can put me in pause if you wanna think about it.
Well, I'm gonna choose, responsible disclosure.
Ethical disclosure is just the process
of actually doing a disclosure.
Limited disclosure, that was a made up term.
And full disclosure is when everything is disclosed
without any thinking about what the ramifications might be,
right, what our adversaries might be able
able to do with that information.
So I'm gonna go with responsible disclosure.
Let's check.
And that is correct.
Question three, a timing and communication flaw
that produces an unexpected result when the timing
of actions impacts other actions,
Race condition, time of evaluation, time of check,
or time of use.
So it's a timing and communication flaw
that produces an unexpected result.
Race condition, time of evaluation, time of check
and time of use.
What do you wanna choose?
I'm gonna choose race condition
because that best describes what a race condition is.
Time of valuation, time of check, and time
of use are all components of a race condition.
But taken together, we're really,
what we're looking at when we talk
about a timing and communication flaw,
we're talking about a race condition.
Let's double check,
and that is correct.
Okay, we are now gonna match the vulnerability
and the type of attack.
Going down, let's see if we can
make it so you can see all of it.
There you go.
Going down the left hand side
we have side channel, multi-tenancy, side loading,
injection, and jail breaking.
And then on the right hand side we've got some descriptions.
A shared infrastructure, bypassing security restrictions,
a physical property weakness that can be exploited,
installing a non-official app,
or insertion of code or commands.
So let's start up here with side channel.
Hmm, as we go through our list,
remember what a side channel is?
it's also a great time to put me
on pause if you wanna like, take time to match this up.
Well, I'm gonna go,
with physical property weakness that can be exploited.
Multi-tenancy, now we talked about multi-tenancy
in the cloud, means when there are multiple tenants,
which sounds a lot like,
a shared infrastructure.
All right, now we have side loading.
And our options are,
bypassing security restrictions,
installing a nonofficial app,
or insertion of code and commands.
Now let's say you get to this point, you're like, oh man
I'm not really sure what that one is.
Well, go ahead to the next one, and then you can come back.
So never, you know,
never hesitate to use a process of elimination,
or, kind of answer one part of the question before another.
So I'm gonna skip that one for now.
Go to injection.
And we know that injection is insertion of code or commands.
And we know that jailbreaking,
is bypassing security restrictions.
So side loading,
well that must have been installing a non-official app.
So let's go through these.
A side channel is a physical property weakness
that can be exploited.
Multi-tenancy, refers to shared infrastructure.
Side loading ,is installing a nonofficial app.
Injection, insertion of code of commands,
and jailbreaking, bypassing security restrictions.
Do you like it?
Let's check it out.
And those are correct.
And let's go to our last question.
And this is asking us to determine
if the flaw description is true or false.
So we're gonna choose true or false
for each one of these statements.
The first statement, I'll read them all
to you actually before we decide.
The first statement is,
a buffer overflow happens when excess data is written
into non allocated system memory.
The second statement,
is a memory leak is a failure of an OS
or application to free up dynamically request memory.
Number three,
directory traversal is the ability to access files
and directories inside of the intended directory.
And number four is,
maintenance hooks are designed to be used
by programmers in the prod,
or in the production environment.
All right, so let's start at the top.
Buffer overflow happens when excessive data
is written into non allocated system memory.
Do you think that's true or false?
I think that's true.
Number two, a memory leak is the failure
of an operating system or an application
to free up dynamically requested memory.
Do you think that's true or false?
I think that's true.
Number three,
directory traversal is the ability to access files
and directories inside of the intended directory.
Hmm, is that gonna be true or false?
Well, if you just read this quickly
and said the ability to access files and directories,
you'd be like, yeah, yeah, that's directory traversal.
But there's a tricky word in here.
Inside of the intended directory.
Remember, directory traversal is really the ability
to access files and directories,
outside of the intended directory.
And so, you know, it feels like you're kinda on a roll.
The first one was true, the second one was true.
Oh, the third one might be true.
But you really always wanna be looking out
for those keywords.
So we're gonna say false.
And lastly, maintenance hooks are designed to be used
by programmers in the prod, or production environment.
True or false?
Those maintenance hooks are really designed to be used when?
Not in prod, but in the development environment.
So we're gonna say false.
So we have two true statements and two false statements.
You agree?
Let's check it out.
And those are correct.
All right, that was great.
Five questions.
I bet you did really well on all of them.
So congratulations.
Up next, we're gonna go right into lesson eight,
given a scenario, analyze indicators of malicious activity.
I'll see you there.