Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Weaponization

Why wrong: Weaponization involves creating an exploit. Hardcoded credentials are a vulnerability, not an exploit.

Installation

Why wrong: Installation is about deploying malware; hardcoded credentials are a pre-existing vulnerability.

Exploitation

Why wrong: Exploitation involves actively leveraging a vulnerability to achieve a goal. Merely finding the credentials is reconnaissance; using them to access the backend would be exploitation.

SSRF

Why wrong: Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can induce a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This attack primarily targets web applications and their underlying infrastructure, allowing an attacker to access internal systems or external services that the server can reach, but it has no direct applicability as a wireless network attack vector itself.

Dictionary attack

Why wrong: A dictionary attack is a brute-force method of password cracking that attempts to guess passwords by systematically trying words from a pre-compiled list, or "dictionary." While it is a technique used against passwords obtained from wireless networks (e.g., WPA/WPA2 PSK handshakes), it is a generic password cracking methodology, not a specific attack against the wireless network protocol or infrastructure itself.

Replay attack

Why wrong: A replay attack involves an attacker intercepting and re-transmitting valid data transmissions, often authentication credentials or session tokens, to trick a system into performing an action or granting access. While replay attacks can occur in wireless contexts, such as replaying captured authentication frames, they are a broad category of network attack applicable across many protocols and network types (wired, wireless, cellular), not a specific attack unique to wireless network vulnerabilities.

SQL injection

Why wrong: SQL injection is a code injection technique that exploits vulnerabilities in an application's database layer. Attackers insert malicious SQL statements into input fields, causing the application to execute unintended database commands. This attack primarily targets data integrity, confidentiality, and availability within a database, but it does not involve breaking or analyzing cryptographic primitives or encrypted data to reveal plaintext. Therefore, it is not considered a cryptanalytic attack.

Cross-site scripting (XSS)

Why wrong: Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts are injected into legitimate websites. When a user visits the compromised site, their browser executes the malicious script, which can steal cookies, session tokens, or other sensitive information, or even redirect the user. XSS primarily exploits vulnerabilities in web application input validation and output encoding, targeting user browsers and web application logic, rather than attempting to break or analyze cryptographic algorithms or encrypted data.

Implement strict input validation on all user-supplied URLs

Why wrong: Strict input validation on user-supplied URLs is a crucial defense-in-depth measure, but it is often insufficient as a standalone SSRF mitigation. Attackers can frequently bypass validation rules using techniques like IP address encoding, URL shorteners, or redirect chains, which still trick the server into accessing internal resources. Therefore, while helpful, it does not provide a robust primary defense against sophisticated SSRF attacks.

Disable the use of external URLs in application features

Why wrong: Disabling the use of external URLs in application features is often an impractical and incomplete solution for SSRF prevention. Many modern cloud applications inherently require the ability to fetch or interact with external resources for core functionalities, making a complete disablement infeasible without breaking the application. Furthermore, this approach does not address potential SSRF vectors where the application might internally construct or resolve URLs to sensitive internal resources, even without direct user input for external links.

Use a web application firewall (WAF) with SSRF signatures

Why wrong: While a Web Application Firewall (WAF) with SSRF signatures can provide some protection, it is generally not a comprehensive solution for Server-Side Request Forgery. WAFs primarily inspect incoming requests and rely on known patterns, which may miss novel SSRF payloads or those targeting unique internal IPs like cloud metadata services. Crucially, a WAF typically does not inspect the *outbound* connections made by the server itself, which is where the actual SSRF exploitation occurs, rendering it ineffective against the core attack vector.

Vulnerable software libraries

Why wrong: Vulnerable software libraries pertain to weaknesses within the code components used by an application, often third-party dependencies, which can be exploited to compromise the application itself. This issue is distinct from cloud IAM policies, which govern *who* can access *what* resources within the cloud provider's infrastructure. IAM policies do not control the security posture or vulnerabilities present within the application's codebase or its underlying libraries.

Weak encryption algorithms

Why wrong: Weak encryption algorithms relate to the cryptographic strength used to protect data at rest or in transit, such as using outdated ciphers (e.g., DES, RC4) or insufficient key lengths. Cloud IAM policies define permissions for identities to *perform* actions related to encryption services (e.g., using a Key Management Service key), but they do not dictate the specific algorithms or cryptographic strengths employed. These settings are typically configured at the service level (e.g., S3 bucket encryption, database encryption settings) or within the application itself.

Insecure MQTT configuration

Why wrong: Insecure MQTT configuration refers to vulnerabilities within the Message Queuing Telemetry Transport protocol, primarily used in IoT environments for lightweight messaging between devices and brokers. Issues like unauthenticated access to MQTT brokers, lack of TLS encryption, or improper authorization rules for topics are specific to the MQTT implementation. These security concerns are entirely separate from cloud provider IAM policies, which manage access to cloud services and resources, not the security of an IoT messaging protocol.

Perform a dictionary attack against the root user password

Why wrong: Performing a dictionary attack against the root user password is an attempt to compromise the master AWS account credentials directly. This is distinct from exploiting a vulnerability within an EC2 instance to obtain its assigned IAM role credentials. The root user password is not typically stored on or accessible via an EC2 instance's metadata service, making this attack vector irrelevant to the scenario of leveraging an instance vulnerability for IAM role credential theft.

Use Pacu to enumerate S3 buckets

Why wrong: Using Pacu to enumerate S3 buckets is a post-exploitation activity, meaning it occurs after an attacker has already obtained valid AWS credentials. Pacu is a powerful open-source AWS exploitation framework, but its primary function is to leverage existing credentials for reconnaissance, privilege escalation, and data exfiltration. The question specifically asks for the method to obtain the IAM credentials in the first place, not how to utilize them once acquired.

Exploit a container escape vulnerability in Docker

Why wrong: Exploiting a container escape vulnerability in Docker would involve breaking out of a containerized environment to gain access to the underlying host operating system. While a significant security concern in containerized deployments, this attack vector is not directly relevant to obtaining IAM credentials via an EC2 instance's metadata service. The question implies an instance-level vulnerability leading to credential theft, without any specific indication or necessity of Docker containers being present or involved in the immediate path to the IAM role.

Use of hardware security modules (HSM)

Why wrong: The use of Hardware Security Modules (HSMs) is a robust security control, not a weakness. HSMs are specialized physical computing devices that safeguard and manage digital keys for strong authentication and cryptographic operations, providing a tamper-resistant environment. Their implementation significantly enhances the security posture of an IoT device by protecting critical cryptographic material from unauthorized access and manipulation, thereby mitigating key compromise risks.

Implementation of secure boot

Why wrong: Implementation of secure boot is a critical security feature designed to prevent malicious software from loading during the device startup process, making it a strength, not a weakness. Secure boot ensures that only digitally signed and trusted firmware and software components are executed, verifying their integrity and authenticity before control is passed. This mechanism establishes a root of trust, protecting the device from persistent malware infections and unauthorized firmware modifications from the earliest boot stages.

Firmware update mechanism with signed updates

Why wrong: A firmware update mechanism that incorporates signed updates is a strong security measure, not a weakness. Signed updates ensure that any new firmware installed on an IoT device originates from a trusted source and has not been tampered with since its release. This cryptographic verification process prevents attackers from installing malicious or unauthorized firmware, which could otherwise compromise the device's functionality, security, or allow persistent access, thereby protecting the device's integrity and authenticity.

The bucket is in a different region than the EC2 instance

Why wrong: Incorrect. The bucket's region relative to EC2 does not affect public access permissions.

The bucket policy grants 's3:GetObject' and 's3:PutObject' to 'Principal': *

Why wrong: Incorrect. While a bucket policy with Principal: * can grant public access, the actions listed (GetObject, PutObject) do not allow listing the bucket. Listing requires s3:ListBucket.

Server-side encryption is disabled

Why wrong: Incorrect. Disabling server-side encryption does not affect access permissions; it only impacts data protection.

WPA2 4-way handshake exchange

Why wrong: Incorrect. The WPA2 4-way handshake uses EAPOL frames, not TCP. The described sequence is a TCP handshake, not the 4-way exchange.

WPS PIN exchange

Why wrong: Incorrect. WPS PIN exchange uses EAP messages at Layer 2, not TCP.

WEP initialization vector capture

Why wrong: Incorrect. WEP IV capture involves WEP frames, not TCP.

SQL injection

Why wrong: SQL injection is a classic web application vulnerability that exploits improper input validation, allowing attackers to manipulate backend database queries. This attack vector targets the application layer and its interaction with a database, regardless of whether the application is hosted on-premises, in a virtual machine, or within a serverless function in the cloud. While cloud environments may host applications susceptible to SQL injection, the vulnerability itself is not inherent to cloud infrastructure or services, making it a general application security concern rather than cloud-specific.

De-authentication attack

Why wrong: A de-authentication attack is a denial-of-service technique specifically targeting wireless networks, where an attacker sends forged de-authentication frames to disconnect legitimate clients from an access point. This attack operates at the MAC layer (Layer 2) of the OSI model and relies on physical proximity to the wireless network infrastructure. Cloud environments, by their nature, abstract away the underlying physical network layer from the end-user or application, meaning such an attack cannot directly target cloud services or infrastructure.

ARP spoofing

Why wrong: ARP spoofing, or ARP poisoning, is a network-level attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. This tricks devices into associating the attacker's MAC address with the IP address of another legitimate host, enabling man-in-the-middle attacks. This vulnerability is specific to broadcast domains and local network segments. While cloud providers use virtual networks, the underlying infrastructure typically prevents direct ARP manipulation by tenants, making it not a cloud-specific threat that a tenant would directly face or exploit against cloud services.

Man-in-the-middle attack

Why wrong: A Man-in-the-middle (MITM) attack is a broad category of attack where an attacker secretly intercepts and relays communication between two parties who believe they are communicating directly with each other. This attack can be performed on virtually any communication medium or protocol, including wired Ethernet, cellular networks, and application-layer protocols like HTTPS, not just wireless. Therefore, it is not an attack specifically associated with wireless networks, as its core principle is independent of the physical layer.

Replay attack

Why wrong: A Replay attack involves an attacker intercepting a valid data transmission and then maliciously retransmitting it later to produce an unauthorized effect, such as replaying authentication credentials. While it can occur in wireless environments, it is a general cryptographic attack applicable to many different communication protocols and systems, including wired networks, financial transactions, and authentication mechanisms that lack proper anti-replay protection. Its occurrence is not exclusive or specific to wireless networks.

Birthday attack

Why wrong: A Birthday attack is a cryptanalytic attack that exploits the mathematics behind the birthday problem to find collisions in hash functions. The goal is to find two different inputs that produce the same hash output, which can be used to forge digital signatures or bypass certain security mechanisms. This attack is purely mathematical and cryptographic in nature, operating at a conceptual level independent of the underlying network's physical or data link layer, thus not specifically associated with wireless communication.

Replay attack

Why wrong: A replay attack targets cryptographic weakness by capturing legitimate, encrypted communication and then retransmitting it later to achieve an unauthorized effect. While the attacker does not need to decrypt the message, the attack exploits the absence of proper freshness mechanisms, such as nonces or timestamps, within the cryptographic protocol. Without these protections, the system cannot distinguish between a legitimate, current message and an identical, replayed message, leading to potential unauthorized actions or state changes.

Cross-site scripting

Why wrong: Cross-site scripting (XSS) is a client-side code injection attack that exploits vulnerabilities in web applications to inject malicious scripts into web pages viewed by other users. This attack primarily targets the end-user's browser and its interaction with the web application, often to steal session cookies, deface websites, or redirect users. XSS does not directly exploit cryptographic algorithms or protocols; instead, it leverages improper input sanitization and output encoding to manipulate client-side content.

SQL injection

Why wrong: SQL injection is a code injection technique that exploits security vulnerabilities in a web application's database layer. Attackers insert malicious SQL code into input fields, which is then executed by the database, allowing unauthorized access, modification, or deletion of data. This attack directly targets the application's database interaction logic and improper input validation, rather than exploiting any cryptographic algorithms, protocols, or their implementations.

WPS PIN brute-force attack

Why wrong: A WPS PIN brute-force attack targets the Wi-Fi Protected Setup (WPS) protocol's 8-digit PIN authentication mechanism. This attack exploits a design flaw allowing the PIN to be validated in two halves, significantly reducing the number of attempts needed to guess the correct PIN. It involves systematically trying various PIN combinations, often by sending authentication requests, rather than passively collecting a large number of unique Initialization Vectors (IVs) from network traffic for cryptographic analysis.

Evil twin AP deployment

Why wrong: An evil twin access point (AP) deployment involves setting up a rogue AP that mimics a legitimate one by using the same Service Set Identifier (SSID). The primary objective is to trick unsuspecting users into connecting to the malicious AP, allowing the attacker to intercept their network traffic, capture credentials through phishing, or inject malware. This attack relies on impersonation and user deception, and it does not involve the collection of numerous unique Initialization Vectors (IVs) as a core mechanism for its operation.

WPA handshake capture

Why wrong: WPA/WPA2 cracking primarily focuses on capturing the 4-way handshake that occurs when a client authenticates with an access point. This handshake contains cryptographic material derived from the Pre-Shared Key (PSK) or EAP credentials, which can then be subjected to offline dictionary or brute-force attacks. Unlike WEP, WPA's robust key derivation functions and larger IVs mean that simply collecting a large number of unique Initialization Vectors (IVs) is not a viable method for recovering the WPA key.

Perform a de-authentication attack on the target AP

Why wrong: Reaver is specifically designed to exploit vulnerabilities in Wi-Fi Protected Setup (WPS) by systematically brute-forcing the WPS PIN. It does not perform de-authentication attacks, which are typically executed using tools like aireplay-ng to disconnect clients from an access point. De-authentication attacks are primarily used to force a client to re-authenticate, often to capture a WPA/WPA2 handshake, a function distinct from Reaver's WPS-focused operation.

Capture the 4-way handshake for WPA cracking

Why wrong: Capturing the 4-way handshake, which is essential for offline WPA/WPA2-PSK cracking, is not a function of Reaver. This process typically involves monitoring wireless traffic with tools such as airodump-ng to intercept the exchange between a client and an access point during authentication. Reaver operates by directly interacting with the WPS protocol to guess the PIN, thereby bypassing the need to capture and crack the WPA handshake.

Scan for nearby access points and their BSSIDs

Why wrong: Scanning for nearby access points and their Basic Service Set Identifiers (BSSIDs) is a network discovery function performed by tools like airodump-ng or iwlist scan. Reaver, on the other hand, is an attack tool that requires the target AP's BSSID, along with its associated wireless interface, as input parameters to initiate its WPS brute-force attack. It does not possess built-in capabilities for network reconnaissance or AP enumeration.

AWS is responsible for physical security of data centers

Why wrong: AWS operates under a shared responsibility model where it is indeed responsible for the "security of the cloud," which includes the physical security of its data centers, hardware, and global infrastructure. However, an S3 bucket misconfiguration, such as an overly permissive policy, falls under the customer's "security in the cloud" responsibilities. Therefore, while the statement about AWS's physical security is true, it does not address the root cause of an exposed S3 bucket.

The customer is responsible for patching the S3 service

Why wrong: Under the AWS shared responsibility model, AWS is fully responsible for the operational aspects and underlying infrastructure of managed services like S3, which includes patching the S3 service itself. Customers are not granted access to the underlying S3 service infrastructure to perform patching or maintenance. The customer's responsibility lies in configuring the service correctly, specifically managing access policies and permissions for their S3 buckets and objects.

AWS is responsible for network infrastructure; the customer for data classification

Why wrong: While AWS is indeed responsible for the underlying network infrastructure that supports S3, ensuring its availability and security, this is part of the "security of the cloud." The customer is responsible for data classification, determining the sensitivity of data stored in S3. However, the specific issue of an exposed S3 bucket stems from misconfigured access controls, which is a customer responsibility for "security in the cloud," not directly related to the underlying network or merely classifying the data.

Disable the MQTT broker entirely and switch to HTTP

Why wrong: Disabling the MQTT broker and switching to HTTP is generally impractical for an existing IoT ecosystem, as devices are often purpose-built for MQTT's lightweight publish/subscribe model. This drastic change would require significant re-engineering and redeployment of all IoT devices. Furthermore, merely switching to HTTP without implementing HTTPS and client authentication would simply replace one insecure communication method with another, failing to address the fundamental lack of secure transport and access control that the original problem presents.

Change the default topic names to obfuscated strings

Why wrong: Changing default topic names to obfuscated strings offers no real security benefit, as this approach relies on 'security by obscurity,' which is not a recognized security control. An attacker can easily discover topic names by subscribing to the '#' wildcard, observing network traffic, or reverse-engineering device firmware. This method does not prevent unauthorized access, provide data confidentiality, or offer any form of authentication for the communication, leaving the system vulnerable.

Use a VPN for all IoT device communication

Why wrong: A VPN encrypts traffic between the IoT device and the broker, but the MQTT protocol itself still lacks authentication; the attacker, already on the same local network, can intercept the decrypted traffic after the VPN tunnel terminates at the broker endpoint. This option is tempting because a VPN is correctly used to secure communications across untrusted networks, and it would be the right choice if the threat were an external attacker on a different subnet rather than a local-network eavesdropper.

RC4

Why wrong: RC4 is classified as a symmetric stream cipher, not a block cipher. Unlike block ciphers that process data in fixed-size chunks, RC4 generates a pseudorandom keystream that is XORed with the plaintext, encrypting data bit by bit or byte by byte. This fundamental difference means it does not operate with a fixed block size, making it distinct from algorithms that encrypt discrete blocks of data.

3DES

Why wrong: Triple DES (3DES) is indeed a symmetric block cipher, but it operates on a fixed block size of 64 bits, not 128 bits. While 3DES applies the DES algorithm three times with either two or three distinct 56-bit (effective) keys to enhance security, its underlying data processing unit remains 64 bits. Therefore, it does not meet the criteria for a 128-bit block size often associated with modern symmetric encryption standards.

RSA

Why wrong: RSA (Rivest–Shamir–Adleman) is an asymmetric cryptographic algorithm, also known as public-key cryptography. Unlike symmetric algorithms that use a single shared secret key for both encryption and decryption, RSA employs a pair of mathematically linked keys: a public key for encryption and a private key for decryption. This fundamental distinction immediately disqualifies it as a symmetric algorithm, regardless of its block processing characteristics.

SQL Injection

Why wrong: SQL Injection exploits vulnerabilities in an application's database queries, allowing attackers to inject malicious SQL code through user input. This attack primarily targets the database layer to retrieve, modify, or delete data, or even execute administrative commands. The observed log entry, however, describes an HTTP request to an internal IP address, not a manipulation of a database query.

Container escape

Why wrong: Container escape refers to a security vulnerability where an attacker breaks out of an isolated container environment to gain unauthorized access to the underlying host operating system. While a critical threat, the log entry indicates a network request originating *from* the server or container to an internal service. This action does not directly represent an attempt to compromise the host system itself, but rather leverages the container's network access.

Cross-Site Scripting (XSS)

Why wrong: Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into legitimate websites and executed in the victim's web browser. This vulnerability typically aims to steal session cookies, deface web pages, or redirect users to malicious sites, impacting the end-user directly. The observed log entry, however, details a server-initiated request to an internal IP, which is a server-side action, not a client-side script execution.

Aircrack-ng

Why wrong: Aircrack-ng is a powerful suite of tools primarily designed for assessing the security of 802.11 wireless networks. Its core functionalities include capturing wireless packets, cracking WEP and WPA/WPA2-PSK keys, and performing deauthentication attacks to test network resilience. This specialized toolkit focuses exclusively on wireless network vulnerabilities, making it entirely unsuitable for auditing cloud service configurations or identifying misconfigurations within cloud provider infrastructure.

Nmap

Why wrong: Nmap, or Network Mapper, is a versatile and widely used open-source utility for network discovery and security auditing. It excels at identifying active hosts on a network, enumerating open ports, detecting services running on those ports, and determining operating system types. While Nmap is invaluable for mapping network topology and identifying potential entry points on traditional networks, it does not possess the capabilities to audit cloud-specific configurations or assess the security posture of cloud services like S3 buckets or IAM policies.

Wireshark

Why wrong: Wireshark is a premier open-source network protocol analyzer that allows for deep inspection of network traffic in real-time or from captured files. It provides granular visibility into individual packets, enabling network administrators and security analysts to troubleshoot network problems, analyze protocol interactions, and perform network forensics. Its primary function is to observe and interpret data flowing across a network, which is fundamentally different from auditing the static configurations and security settings of cloud infrastructure.

Use aircrack-ng to crack the WEP key from the handshake

Why wrong: Using aircrack-ng to crack a WEP key from a WPA2 4-way handshake is fundamentally incorrect because WEP and WPA2 are distinct security protocols with different key derivation and authentication mechanisms. WEP cracking primarily relies on collecting a large number of Initialization Vectors (IVs) to exploit cryptographic weaknesses, whereas a WPA2 handshake is used for offline dictionary or brute-force attacks against the Pre-Shared Key (PSK). A WPA2 handshake contains no relevant information for WEP key recovery.

Brute-force the WPS PIN using Reaver

Why wrong: Brute-forcing the WPS PIN using Reaver is an attack targeting Wi-Fi Protected Setup (WPS), a separate protocol designed for simplified network configuration, not the WPA2 4-way handshake itself. Reaver exploits a design flaw in WPS's PIN authentication process, allowing an attacker to guess the 8-digit PIN in two halves through active online attempts against the access point. This method does not utilize a captured WPA2 handshake and is ineffective if WPS is disabled or not present on the target network.

De-authenticate the client from the network again to capture another handshake

Why wrong: De-authenticating the client from the network again to capture another handshake is unnecessary and provides no additional advantage for cracking the WPA2 Pre-Shared Key (PSK). A single complete and valid 4-way handshake contains all the cryptographic material required for an offline dictionary attack against the PSK. Capturing multiple handshakes from the same network with the same PSK merely duplicates the existing data and does not enhance the chances or speed of cracking the password.