- So welcome to lesson eight, deep dive quiz.
The lesson eight was all about, given a scenario,
analyze indicators of malicious activity.
And we looked at all kinds of malicious activity.
We started in lesson 8.1 one of saying, okay,
well what is an indicator?
And then in 8.2, we looked at malware attacks.
In 8.3, brute force attacks,
8.4 digital infrastructure attacks,
8.5 application attacks, 8.6 wireless attacks.
And lastly, in 8.7 cryptographic attacks.
All with the goal that if you are given a scenario
you could analyze the indicators of the malicious activity.
So now together, let's do 10 questions.
Make sure you've got a pen or a pencil and a piece of paper.
Keep putting me on pause so you can answer the question
and take me off pause and come back and hear the answer.
So let's start our quiz.
Ready, 1, 2, 3, let's go.
The first thing we're gonna do is match the attack category
and the description.
So the attack categories on the left hand side.
Denial of service, hijacking, web hijacking,
poisoning, and spoofing.
On the right hand side, we have our descriptions.
Intercepting and manipulating communication, misdirection,
impersonating an address, system or person,
overwhelming system resources,
manipulating a trusted source of data.
Great time to put me on pause so you can match them up.
All right, well, I'm gonna start right up on the top.
Denial of service.
And if I look through my list, I'm gonna choose
overwhelming system resources as a denial of service.
Now, 'cause I've got hijacking and if I look
through my list, that's going to be intercepting.
So I'm gonna hijack or intercept
and manipulating communications.
Then I have web hijacking.
Now, what does web hijacking usually result in?
Well, web hijacking, right, usually results
in misdirection, right?
Misdirection to another domain or another location.
Then we've got poisoning and spoofing.
So what's the difference?
Well, poisoning is going to be manipulating
a trusted source of data, like DNS zone files
or a routing table or an arp cache.
And spoofing is impersonating an address,
a system or a person.
So denial of service, overwhelming system resources.
Hijacking, intercepting and manipulating communications.
Web hijacking, misdirection.
Poisoning, manipulating a trusted source of data
and spoofing, impersonating an address,
a system or a person.
Do you like it, do you agree?
We'll check and that's correct.
All right, let's go to number two.
To everyone's surprise, on December 31st,
a software application appeared
to intentionally self-destruct.
So everybody's gone for the day probably,
it's New Year's Eve, it's time to party.
And all of a sudden this software application
intentionally self-destructs.
What's the most likely cause?
A logic bomb, bloatware, ransomware, or a backdoor?
Remember, it's happening at a specific time, December 31st.
What are you gonna choose?
Logic bomb, bloatware, ransomware, or a backdoor?
Well, I'm gonna choose logic bomb.
Logic bomb because it happened at a particular time.
Bloatware is the unwanted applications,
potentially unwanted applications.
Ransomware would encrypt our files, not destroy them.
And a backdoor, well, would be when someone gets
into our application and that's not happening here, right?
The application appeared to intentionally self-destruct.
I'm betting on a logic bomb.
Let's check it and that's correct.
Question three.
An adversary was able to authenticate
to a consumer online banking system
using multiple customer credentials.
Every time, every single time,
they had the correct username and password.
So what's the most likely method used
for discovering the credentials?
Dictionary, rainbow table, basic discovery attack
and informed.
So every time they had a right username
they seemed to have the right password as well.
How did they do that?
Dictionary, rainbow table, basic discovery attack
or informed?
I'm gonna choose informed, right?
Informed means that they already
have a known good source, right?
And they're using that known good source
to attempt to get in, in this case,
get into the banking system.
So there it's informed.
Dictionary would be using common dictionary words.
A rainbow table would be, you know, we can have the hashes
and the passwords that come from a rainbow table.
Basic discovery attack is using everything, right?
So both, you know, dictionary, rainbow
and basic attack are probably going to result
in a lot of false credentials, but informed, wow,
they've got the information.
Let's try it and that would be correct.
So question four.
We're gonna choose a correct choice in each dropdown list.
First, I'm gonna read you the questions
'cause maybe you just already know the answer.
Then we'll come back and we'll look at our choices.
Malicious code whose primary function is to replicate
and deliver its payload.
A clandestine program designed to provide
continued privileged access.
A malware technique that evades pattern matching detection
by frequently changing identifiable characteristics
and malicious code that appears legitimate.
Now hopefully you know what all of those are,
but let's go through our dropdowns
and see what our choices are.
Malicious code whose primary function is to replicate
and deliver its payload.
Is that a rootkit, a virus, a worm, or a Trojan?
What are you gonna select?
Well, I'm gonna choose virus.
The next is a clandestine program designed
to provide continued privileged access.
Programmatic, injection, spyware, or a rootkit?
Provide continued privileged access.
Privilege is a really important word here.
I'm gonna go with rootkit.
Our next one is malware technique
that evades pattern matching detection
by frequently changing identifiable characteristics.
Metamorphic, armored, stealth or polymorphic?
Now what's really common to confuse
metamorphic and polymorphic.
Polymorphic is when characteristics are changed.
Metamorphic is when we have a whole new piece
of malware with every single iteration.
So in this case, I'm gonna choose polymorphic.
And lastly, malicious code that appears legitimate.
Is this programmatic, Trojan, a virus or a worm?
So it appears to be fine.
It appears like it's a music file
or it's a game, or it's a picture.
What is it?
I'm gonna choose Trojan.
So malicious code whose primary function is to replicate
and deliver its payload, a virus.
A clandestine program designed
to provide continued privilege access, a rootkit.
Malware technique that evades pattern matching
detection by frequently changing its identifiable
characteristic, polymorphic.
And malicious code that appears legitimate, a Trojan.
You agree?
Let's try it and that's correct.
All right, let's move on to question five.
SSL is considered deprecated and has been replaced with TLS.
However many servers still have SSL enabled
for backward compatibility.
Is this a problem?
All right, everybody's gonna get this one right.
Not a problem because most browsers only support TLS.
This is a problem because the attacker can force
a downgrade to SSL.
This is a problem because SSL has more significant overhead
or not a problem because TLS has priority.
I know you're gonna get this right.
We talked about this in the lesson.
We talked about this in the security and action case study.
Not a problem, because most browsers support only TLS.
Well, it's true that most browsers only support TLS now
but that's not really relevant.
Is a problem because an attacker can force
a downgrade to SSL?
Yeah, I think that's a big problem.
Not a problem because SSL has more significant overhead?
That's not relevant.
Not a problem because TLS has priority.
Again, not relevant.
If the attacker can force a downgrade attack,
it is a problem.
Again, because the attacker can force a downgrade attack.
I hope you agree.
Let's check it out and that's correct.
All right, in this variation
of a cross-site scripting attack,
the attacker injects a malicious code into the webpage.
Is this an XRSF, a persistent XXS, cross-site scripting,
a client side cross-site scripting,
or a reflective cross site scripting?
So only two of these are really cross site scripting
types of attacks we've talked about, and only one
of them is gonna be the correct answer.
So cut start using that process of elimination.
In this case, the attacker injects the malicious code
into the webpage.
Persistent, client side, reflective or XRSF?
What are you gonna choose?
I'm gonna choose persistent.
In a persistent cross-site scripting attack, right,
the malicious code is in the webpage and so every time
someone visits that webpage there's a potential
that they're gonna be ultimately compromised.
Reflective cross-site scripting
which is the other one that we talked about
is when the script starts at the client side,
gets injected into the website
and it's reflected back to the client.
So persistent is the one I like.
Hopefully you do, too.
Let's check it out and that's correct.
Question seven.
Which of the following artifacts is a distributed denial
of service or DDoS IOC, indicator of compromise?
Traffic volume, a virus signature,
modified registry settings or renamed files?
So we're looking for an artifact, right?
That is an IOC, right. an indicator of compromise
about a distributed denial of service attack.
So which one of these makes the most sense?
Traffic volume, virus signatures
modified registry setting, or renamed files.
Go ahead and make that choice.
I'm gonna choose traffic volume
because a distributed denial of service
is all about traffic, right?
That's gonna be the most likely artifact
that we're gonna look for in a distributed
denial of service attack.
You agree?
Let's check and that is correct.
All right, question eight.
This technique best prevents an injection attack
from successfully executing.
A bash script, time synchronization, firewall filtering
or input and output validation.
Our goal is to prevent an injection attack
from successfully executing.
Which one do you like?
Bash, time synchronization, firewall filtering
or input and output validation?
There's one answer here that stands way
out above the the rest, and it's this one right here.
Input and output validation, right?
If we have input validation, then we can't input any type
of instructions that would be executed by the processor.
And output validation says we're not gonna return
anything that shouldn't be returned back to the user.
Let's check it out and it is correct.
All right, question nine.
We're gonna match the following wireless attacks
with the attack attribute and description.
So on the left hand side we have RFID eavesdropping,
a replay attack, disassociation, bluesnarfing and evil twin.
And on the right hand side, we have the type
of attack and kind of what's happening, right?
Hijacking in this case, reusing authentication credentials,
access for authentication,
spoofing for impersonation, sniffing, doing packet capture
and the denial of service for deauthentication.
So where should we start?
Let's start with denial of service and deauthentication.
It's really a disassociation attack.
Access and authentication.
Oh, that's gonna be bluesnarfing for sure.
A replay attack?
Well, that would be hijacking
and then reusing authentication credentials.
Let's see.
And evil twin is impersonation and spoofing, right?
Impersonating a legitimate access point.
And lastly, RFID eavesdropping, sniffing and packet capture.
So RFID eavesdropping, sniffing and packet capture.
Replay, hijacking or reusing authentication credentials.
Disassociation, denial of service and deauthentication.
Bluesnarfing, access and authentication,
and evil twins, spoofing and impersonation.
Let's see how we did, fingers crossed and it is correct.
All right, here's our last question.
I want you to put the first four steps
in the cyber kill chain in the correct order.
Remember, we talked about the Lockheed Martin
cyber kill chain.
I want you to put the first four steps
in the correct order.
Starting with number one, what's the first thing
that we're gonna have happen?
Well, our attackers need to learn about us
so we're gonna start with reconnaissance.
Then we're going to have weaponization.
Then we're going to deliver our weapon
and then we'll exploit.
Reconnaissance, weaponization, delivery, exploit.
Do you like it, you agree?
All right, let's check it out.
And that is correct.
Awesome, you did great.
10 questions is a lot of material that we covered.
You probably deserve a break, but when you're ready
we're gonna go to lesson nine, which is explain the purpose
of mitigation techniques used to secure the enterprise.
So I'll see you there.