Case 05: The Vantage City Permits Portal

The evidence

The questions

1. Analyze E1 Choose one

   1. Lines 2 and 3 in Evidence 1 most likely show which attack, and which security goal did it breach?

   Lines 2 and 3 in Evidence 1 most likely show which attack, and which security goal did it breach?

   ACross site scripting, breaching availabilityBSQL injection, breaching confidentialityCDirectory traversal, breaching integrityDBuffer overflow, breaching availability
   Show answer

   Answer: B. A quote, OR 1=1, the -- comment and SQL control words UNION, SELECT and FROM in user input are indicators of structured query language (SQL) injection. Returning applicants’ names and addresses is a breach of confidentiality. CED 5.1.B.4, 5.6.E.1

2. Detect E1E2 Choose one

   2. Line 4 in Evidence 1 returned status 200. What does this most likely mean?

   Line 4 in Evidence 1 returned status 200. What does this most likely mean?

   AA buffer overflow crashed the forms serviceBA resident downloaded an ordinary permit formCDirectory traversal succeeded and returned db.confDInput sanitization blocked the request safely
   Show answer

   Answer: C. The ../ sequences climb out of the forms folder to the config folder. Status 200 means the server answered. The application runs as portal, the owner of db.conf, so it could read the file and return it. CED 5.6.E.4

3. Analyze E1 Choose one

   3. Which statement best describes line 5 in Evidence 1?

   Which statement best describes line 5 in Evidence 1?

   ASQL injection that deletes the feedback tableBA buffer overflow in the feedback form fieldCStored (Type II) XSS that runs for every viewerDReflected (Type I) XSS that runs only for the sender
   Show answer

   Answer: C. A script tag posted through a form and saved (201) is stored cross site scripting (XSS): it affects every user who loads the page, which explains the residents’ pop-up. CED 5.1.B.6, 5.6.E.2

4. Mitigate E1 Choose one

   4. Which single change to the portal’s code would best help prevent the attacks in lines 2, 3, 4 and 5?

   Which single change to the portal’s code would best help prevent the attacks in lines 2, 3, 4 and 5?

   ASanitize or reject input with control characters, tags or ../BPlace honeypot files in the exports and config foldersCEncrypt the applicants database and its backups with AESDUse longer RSA keys for the portal's website certificate
   Show answer

   Answer: A. Input sanitization protects against SQL injection, XSS and directory traversal attacks. Encryption and honeypots do not stop the input from being processed. CED 5.5.B.1, 5.5.B.2

5. Mitigate E2 Choose one

   5. Which command applies least privilege to db.conf while letting the owner read and write it and the devteam group read it?

   Which command applies least privilege to db.conf while letting the owner read and write it and the devteam group read it?

   Achmod 644 db.confBchmod 640 db.confCchmod 777 db.confDchmod 664 db.conf
   Show answer

   Answer: B. Owner rw- (6), group r-- (4), others --- (0). The current 644 lets every other user read the database password. CED 5.2.D.6, 5.2.C.7

6. Detect E3 Select all that apply

   6. Select every entry in Evidence 3 that is an indicator of an attack on data.

   Select every entry in Evidence 3 that is an indicator of an attack on data.

   A10:20 open of 0412.pdf by r.alvarezB22:31 copy of applicants_full.csv from an unknown deviceC22:40 delete of access.log.1D22:33 open of staff_bank_details.xlsx
   Show answer

   Answer: B, C, D. Copying sensitive files outside the account’s normal time and device, opening the honeypot and deleting a log are all suspicious. r.alvarez opened one permit during the day on a city laptop. CED 5.6.A.1, 5.6.A.2

7. Detect E4 Choose one

   7. Based on Evidence 4, which file was altered?

   Based on Evidence 4, which file was altered?

   Aapplicants.dbBindex.phpClogin.phpDfeedback.php
   Show answer

   Answer: C. Only login.php has a different hash, and no updates were installed, so it was altered between the two hashes. CED 5.6.D.3

8. Analyze E3E4 Choose one

   8. The hash of applicants.db did not change, yet applicant data were stolen. Which of the following best explains this?

   The hash of applicants.db did not change, yet applicant data were stolen. Which of the following best explains this?

   AThe adversary changed both the file and its baselineBSHA-256 cannot produce hashes of database filesCReading or copying data does not change its hashDThe hash function gives different outputs each time
   Show answer

   Answer: C. Cryptographic hash functions only detect if data have been altered. Viewing or stealing data without altering them produces a false negative. CED 5.6.C.3

9. Analyze E1 Choose one

   9. Applicants’ names and home addresses were exposed. How should the city classify these data?

   Applicants’ names and home addresses were exposed. How should the city classify these data?

   APersonally identifiable information (PII)BProtected health information (PHI)CPublic data that need no protectionDPayment card information (PCI)
   Show answer

   Answer: A. PII is any data that allows someone to be identified, including name and address. CED 5.2.A.3, 5.2.A.4

10. Detect E3 Choose one

    10. The honeypot was opened at 22:33, but no one noticed until the news story the next morning. Which change would most help the city respond during the next attack?

    The honeypot was opened at 22:33, but no one noticed until the news story the next morning. Which change would most help the city respond during the next attack?

    AReview the file access log at the end of each monthBEncrypt the honeypot file so it cannot be readCAlert in real time when the honeypot is openedDHash the honeypot file and compare it every week
    Show answer

    Answer: C. Honeypots offer near instantaneous detection when they raise alerts, allowing a prompt response. Retrospective reviews and hash checks find attacks only after they occur. CED 5.6.C.1, 5.6.C.2