Attacks/Encryptions/Regs CEH 2.5

Match the following attack types.

• aLTEr Attack

• Hacker intercepts communications between a user's web browser and a server and is able to decrypt the information.

• Slowloris Attack

• Attacker gains access to Hard Coded Keys used in a Random Number generator (RNG) and can use them to compromise communications.

• DUHK Attack

• An attacker making a computer talk to another computer very, very slow to draw out a conversation.

• DROWN Attack

• Leverages weaknesses in web servers that accepts deprecated SSL protocols, allowing an attacker to decrypt sensitive information.

• POODLE Attack

• Targets an LTE network and intercepting information between a mobile device and the network tower.

Match the following attack types:

• Deauthentication Attack

• an attacker uses a cryptographic attack that exploits information gained from padding errors in an encryption system.

• DroidSheep

• Attacker collects information by sending a deauthentication message that will cause a device to send a reauthentication request to a server.

• Agent Smith Attack

• A malicious software program that attempts to replicate itself onto other programs.

• Padding Oracle Attack

• Android application that is known for its use in demonstrating security vulnerabilities rather than for malicious purposes

• Trident

• A vulnerability that allows and attacker to jailbreak an IOS device and install Pegasus Software.

Match the following CVSS Scores.

• 0.1-3.9

• Low

• 0.0-0.1

• Medium

• 4.0-6.9

• Critical

• 9.0-10.0

• High

• 7.0-8.9

• None

Match the following regulations.

• PCI DSS

• U.S. government program that standardizes the security assessment, authorization, and continuous monitoring processes for cloud products and services. It aims to ensure that cloud solutions used by federal agencies meet specific security standards.

• GLBA

• federal law that defines a comprehensive framework to protect government information, operations, and assets. requires Federal agencies to develop and maintain security programs.

• FISMA

• U.S. federal law enacted to enhance corporate governance and financial reporting transparency. It establishes requirements for financial reporting, internal controls, and the accountability of corporate officers to prevent fraudulent activities.

• SOX

• a set of security standards designed to ensure the secure handling of credit card information during transactions. It applies to organizations that process, store, or transmit credit card data and aims to prevent data breaches and theft of cardholder information.

• FedRAMP

• U.S. law that addresses the protection of consumers' personal financial information held by financial institutions. It requires institutions to establish privacy and security programs to safeguard sensitive financial data.

Answer explanation

FISMA (Federal Information Security Management Act)

HIPAA (Health Insurance Portability and Accountability Act)

SOX (Sarbanes-Oxley Act)

FedRAMP (Federal Risk and Authorization Management Program)

GLBA (Gramm-Leach-Bliley Act)

PCI DSS (Payment Card Industry Data Security Standard)

Match the following encryption types to the correct category.

Groups:

(a) Symmetric (1-Key)

,

(b) Asymmetric (2-Key)

,

(c) Hash

• Serpent

• SHA256

• ECC

• Whirlpool

• RSA

• DSA

• 3DES

• AES

• Blowfish

• ECDSA

• NTLM

• Two Fish

• Diffie Hellman

• MD5

• ECDH

Answer explanation

REDD fishES

RSA/DSA/ECC/DH - A

All fish/AES/DES/Serpent/CAST

Match the following attack types.

• BlueSnarfing

• attack that involves unauthorized access to a device's data, such as contacts, calendars, emails, and other stored information.

• BlueBugging

• exploits vulnerabilities in the Bluetooth protocol to gain control over the targeted device allowing unauthorized monitoring and control features.

• BlueJacking

• attacker sends unsolicited messages or business cards to Bluetooth-enabled devices within range, typically appearing as pop-up messages on a device.