Case 04: The Vantage Transit Kiosks

The evidence

23:58:01  kiosk_admin  203.0.113.40  SSH  failed
23:58:02  ops          203.0.113.40  SSH  failed
23:58:03  backup       203.0.113.40  SSH  failed
23:58:04  j.moreau      203.0.113.40  SSH  failed
00:31:17  j.moreau      203.0.113.40  SSH  success
00:33:52  j.moreau      203.0.113.40  SSH  sudo: added user "maint" to group admin

os.update.status      last patched 160 days ago
firmware.password     none
antimalware.status    installed, signatures 160 days old
login.lockout         disabled
mfa.ssh               not required

/opt/kiosk/update/kiosk_patch.sh   hash matches Ransom.KioskLock   quarantined
/tmp/.cache/svc_helper             hash matches RAT.Backdoor       quarantined
scheduled task "nightly_sync"      created 00:40 by maint          flagged

The questions

1. Analyze E1E2 Choose one

   1. Which firewall rule in Evidence 1 allowed the SSH connections from 203.0.113.40 in Evidence 2?

   Which firewall rule in Evidence 1 allowed the SSH connections from 203.0.113.40 in Evidence 2?

   ARule 2BRule 3CRule 1DRule 4
   Show answer

   Answer: A. Rule 2 allows inbound SSH on port 22 from ALL sources, so the outside address matches it before the default deny in rule 4. Rule 1 covers only port 443 from the internal network. CED 4.3.D.2

2. Mitigate E1 Choose one

   2. Which change to Evidence 1 would best block outside SSH while letting internal technicians keep working?

   Which change to Evidence 1 would best block outside SSH while letting internal technicians keep working?

   AMove rule 4 above rule 1BChange rule 2’s source from ALL to 10.50.0.0/16CDelete rule 1DChange rule 3 to Deny
   Show answer

   Answer: B. Restricting the source keeps SSH for the internal network and lets the default deny catch everyone else. Moving rule 4 to the top would block all inbound traffic, including kiosks. CED 4.3.D.3, 4.3.D.4

3. Detect E2 Choose one

   3. What do the four entries from 23:58:01 to 23:58:04 most likely show?

   What do the four entries from 23:58:01 to 23:58:04 most likely show?

   AAn offline password attackBCredential stuffingCA normal shift changeDPassword spraying
   Show answer

   Answer: D. Many different users tried within seconds of each other from one unusual IP address is the indicator of password spraying. CED 4.4.D.3

4. Detect E2 Choose one

   4. Why is the 00:31:17 login a strong indicator that j.moreau’s password is compromised, even though it succeeded?

   Why is the 00:31:17 login a strong indicator that j.moreau’s password is compromised, even though it succeeded?

   ASuccessful logins are always attacksBSSH logins cannot succeed after failuresCThe username is spelled incorrectlyDIt came at an unusual time from an IP address the technician never uses
   Show answer

   Answer: D. An authorized user logging in from an unexpected IP address or at an unusual time can indicate a compromised password. CED 4.4.D.2

5. Detect E2E4 Select all that apply

   5. Select every indicator of compromise in Evidence 2 and Evidence 4.

   Select every indicator of compromise in Evidence 2 and Evidence 4.

   AA file whose hash matches known ransomwareBA new user "maint" added to the admin group at 00:33:52CA scheduled task created at 00:40 by the new accountDThe technician’s office IP range in the note
   Show answer

   Answer: A, B, C. Adding an account to the admin group is an attempt to elevate privileges (behavior-based); a file hash matching known malware is file-based; an unexpected scheduled task created by the new account is host-based. The office IP range is normal context. CED 4.4.A.4, 4.4.A.6

6. Analyze E4 Choose one

   6. The file /tmp/.cache/svc_helper matched RAT.Backdoor. What does this type of malware give the adversary?

   The file /tmp/.cache/svc_helper matched RAT.Backdoor. What does this type of malware give the adversary?

   AA copy of every keystroke typedBA way to spread to other computers with no interactionCRemote access to the systemDEncryption of the kiosk files for ransom
   Show answer

   Answer: C. A remote access trojan (RAT) provides an adversary with remote access to the target system. CED 4.1.B.2

7. Analyze E3E4 Choose one

   7. The malware was only caught after a signature update. Which finding in Evidence 3 best explains why it was missed earlier?

   The malware was only caught after a signature update. Which finding in Evidence 3 best explains why it was missed earlier?

   ASSH did not require MFABThe firmware had no passwordCLockout was disabledDAnti-malware signatures were 160 days old
   Show answer

   Answer: D. Anti-malware matches files against its signature database; with a 160-day-old database it cannot recognize newer malware. CED 4.3.B.2

8. Mitigate E2E3 Choose one

   8. Evidence 2 shows j.moreau’s password was guessed after a single failed attempt on that account. Which setting in Evidence 3, if fixed, would most directly have stopped the adversary logging in?

   Evidence 2 shows j.moreau’s password was guessed after a single failed attempt on that account. Which setting in Evidence 3, if fixed, would most directly have stopped the adversary logging in?

   AEnable account lockout after 5 invalid attemptsBRequire MFA for SSHCSet a firmware passwordDEnable password complexity
   Show answer

   Answer: B. With MFA, a guessed password alone is not enough. Lockout would not have helped here: password spraying tries each account once, staying under any lockout threshold. A firmware password protects against physical boot attacks. CED 4.2.C.6

9. Mitigate Choose one

   9. The analyst learns the adversary also copied the server’s user:password hash file. What should the organization do?

   The analyst learns the adversary also copied the server’s user:password hash file. What should the organization do?

   AReset only j.moreau’s passwordBCheck the logs for the offline cracking attemptsCForce every user to reset their passwordDNothing, because hashes cannot be reversed
   Show answer

   Answer: C. If a user:password hash database is compromised, every password in it should be considered insecure and all users forced to reset. Offline cracking cannot be seen in the logs. CED 4.4.D.1, 4.4.D.5

10. Detect Choose one

    10. The city wants detection for both the management server and the 60 kiosks, whose embedded computers have very little processing power. Which plan fits best?

    The city wants detection for both the management server and the 60 kiosks, whose embedded computers have very little processing power. Which plan fits best?

    AAnomaly-based detection running on every kioskBNo detection on the server, because it has a firewallCHybrid detection running on every kioskDHybrid detection on the server; lightweight signature-based detection or off-device monitoring for the kiosks
    Show answer

    Answer: D. Critical devices benefit from hybrid detection when possible, while devices with limited resources suit signature-based tools or cannot run detection tools at all. CED 4.4.B.1, 4.4.B.3