Attacks/Encryptions/Regs CEH 2.5

Match the following attack types.

• aLTEr Attack

• Targets an LTE network and intercepting information between a mobile device and the network tower.

• DUHK Attack

• Attacker gains access to Hard Coded Keys used in a Random Number generator (RNG) and can use them to compromise communications.

• DROWN Attack

• Hacker intercepts communications between a user's web browser and a server and is able to decrypt the information.

• POODLE Attack

• An attacker making a computer talk to another computer very, very slow to draw out a conversation.

• Slowloris Attack

• Leverages weaknesses in web servers that accepts deprecated SSL protocols, allowing an attacker to decrypt sensitive information.

Match the following attack types:

• Trident

• A malicious software program that attempts to replicate itself onto other programs.

• DroidSheep

• an attacker uses a cryptographic attack that exploits information gained from padding errors in an encryption system.

• Agent Smith Attack

• Android application that is known for its use in demonstrating security vulnerabilities rather than for malicious purposes

• Deauthentication Attack

• Attacker collects information by sending a deauthentication message that will cause a device to send a reauthentication request to a server.

• Padding Oracle Attack

• A vulnerability that allows and attacker to jailbreak an IOS device and install Pegasus Software.

Match the following CVSS Scores.

• 9.0-10.0

• None

• 7.0-8.9

• Medium

• 4.0-6.9

• Critical

• 0.1-3.9

• Low

• 0.0-0.1

• High

Match the following regulations.

• PCI DSS

• federal law that defines a comprehensive framework to protect government information, operations, and assets. requires Federal agencies to develop and maintain security programs.

• FedRAMP

• U.S. government program that standardizes the security assessment, authorization, and continuous monitoring processes for cloud products and services. It aims to ensure that cloud solutions used by federal agencies meet specific security standards.

• GLBA

• U.S. law that addresses the protection of consumers' personal financial information held by financial institutions. It requires institutions to establish privacy and security programs to safeguard sensitive financial data.

• SOX

• a set of security standards designed to ensure the secure handling of credit card information during transactions. It applies to organizations that process, store, or transmit credit card data and aims to prevent data breaches and theft of cardholder information.

• FISMA

• U.S. federal law enacted to enhance corporate governance and financial reporting transparency. It establishes requirements for financial reporting, internal controls, and the accountability of corporate officers to prevent fraudulent activities.

Answer explanation

FISMA (Federal Information Security Management Act)

HIPAA (Health Insurance Portability and Accountability Act)

SOX (Sarbanes-Oxley Act)

FedRAMP (Federal Risk and Authorization Management Program)

GLBA (Gramm-Leach-Bliley Act)

PCI DSS (Payment Card Industry Data Security Standard)

Match the following encryption types to the correct category.

Groups:

(a) Symmetric (1-Key)

,

(b) Asymmetric (2-Key)

,

(c) Hash

• AES

• Blowfish

• Two Fish

• Diffie Hellman

• SHA256

• MD5

• Whirlpool

• Serpent

• RSA

• 3DES

• ECDH

• DSA

• NTLM

• ECDSA

• ECC

Answer explanation

REDD fishES

RSA/DSA/ECC/DH - A

All fish/AES/DES/Serpent/CAST

Match the following attack types.

• BlueJacking

• attack that involves unauthorized access to a device's data, such as contacts, calendars, emails, and other stored information.

• BlueSnarfing

• exploits vulnerabilities in the Bluetooth protocol to gain control over the targeted device allowing unauthorized monitoring and control features.

• BlueBugging

• attacker sends unsolicited messages or business cards to Bluetooth-enabled devices within range, typically appearing as pop-up messages on a device.