GIAC Certified Incident Handler (GCIH) — Questions 301–322

Rainbow tables are precomputed tables of hashes for all possible plaintext passwords within a specific character set. By adding a random, per-user salt before hashing, the final hash becomes dependent on both the password and the salt. This means an attacker would need to build a new rainbow table for every unique salt, rendering precomputed tables computationally useless.

Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a DoS, or execute arbitrary code. By manipulating the serialized object, an attacker can modify application state, bypass authentication, or leverage existing application code (gadget chains) to gain remote code execution. This is critical because modern frameworks often automatically deserialize objects from user-provided data without sufficient verification or integrity checks on the source.

An LLM hallucination occurs when the model generates confident but factually incorrect information. When analyzing binaries, this manifests as the model identifying non-existent vulnerabilities or describing functions that do not actually exist in the provided code. This is dangerous because it can lead an analyst to waste time chasing false positives or implementing incorrect remediations based on the AI's plausible-sounding but erroneous technical assessment of the binary.

Industrial control systems (ICS) and legacy devices are often highly sensitive to high-traffic volumes. Using T0 (paranoid) or T1 (sneaky) ensures that packets are sent at a slow rate, giving these devices sufficient time to process requests. This minimizes the risk of a buffer overflow or service crash that could result from overwhelming the device's limited computational resources with modern scanning speeds.

The crash is caused by the deserializer recursively building an extremely deep object graph from attacker-supplied JSON, exhausting CPU and memory. When an API binds untrusted JSON directly to internal models without enforcing maximum depth, size, or allowed-property rules, the parsing stage itself becomes the attack surface. Incident handlers should correlate the crash with payload structure, then recommend depth limits, schema validation, and safe parser configuration.

The two characteristics that make hashes more resistant to offline cracking are the use of a slow key derivation function (like bcrypt) and the inclusion of a unique random salt per hash. A slow KDF increases the time required to compute each hash, while salting prevents the use of precomputed tables and ensures that identical passwords yield different hashes. Together, they significantly raise the cost for an attacker.

Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

The application must correlate the authenticated user's identity (from the session) with the requested resource identifier on the back-end. By checking if the session user owns the requested resource ID before returning data, the application enforces authorization. This moves the logic from 'is this user allowed to access anything?' to 'is this user allowed to access THIS SPECIFIC object?', which is the foundation of secure resource access control.

Fabricated reconnaissance output is best prevented by restricting the model to extraction and summarization of the records actually provided, then verifying every hostname against those records programmatically. This removes free generation of entities and adds an independent check. Adjusting temperature, trusting self-reported confidence, or relying on a larger model all leave the model free to invent data and provide no deterministic validation against the source records.

For offline brute-force attacks against NTLM hashes, password length is the most critical factor because it exponentially increases the search space. Other policies like history, age, and lockout are useful for online attacks but do not significantly hinder offline cracking. Thus, increasing the minimum length to 14 characters is the most effective change.

Standard cryptographic hashes like SHA-256 are designed for speed, which is a disadvantage when storing passwords because it allows attackers to test millions of guesses per second. KDFs like Argon2 are specifically designed to be slow and resource-intensive (memory-hard). By forcing the hardware to consume significant memory and time for every single hash calculation, KDFs make large-scale brute-force and dictionary attacks computationally expensive, providing much better security for sensitive credentials.

An AI confidence score of 0.55 with a packer flag is inconclusive, so the responder must validate the hypothesis with behavioral evidence. Dynamic sandbox detonation exposes the malware's actual actions, which can then be correlated with network and endpoint telemetry to confirm malicious intent. Only after corroboration should containment or escalation occur, avoiding both premature blocking and premature dismissal.

Credential stuffing uses previously leaked username/password pairs from one service to gain unauthorized access to another. It differs from a dictionary attack because it utilizes valid, known credentials rather than guessing passwords. This is highly effective because users often reuse passwords across multiple sites, making it a critical threat to organizations that do not enforce multifactor authentication (MFA) or monitor for logins from unusual locations.

Prompt injection occurs when untrusted input is treated as an instruction by the LLM. Implementing structured input validation and separating user input from system instructions is critical. By using delimiters like XML tags or JSON structures to encapsulate user-supplied data, the LLM can clearly distinguish between instructions and data, reducing the likelihood that the model will follow malicious commands embedded within the processed security data or incident reports.

MFA introduces a secondary requirement that is independent of the password. Even if an attacker obtains the password through phishing, credential stuffing, or a database breach, they cannot gain access without the second factor (like a physical security key or a time-based token). This breaks the single point of failure that exists with password-only systems, rendering stolen credentials useless for unauthorized account access, which is the ultimate goal of the adversary.

The correct answer is ransomware encrypting files via SMB. The sequence of opening document files and overwriting them with encrypted data is a hallmark of ransomware. The other options do not match the observed traffic: exfiltration would read files, brute-force would show failed logons, and worm propagation would target multiple hosts.

Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

The primary risk of unsalted hashes is that attackers can use precomputed rainbow tables to quickly crack common passwords and that identical passwords yield identical hashes, exposing password reuse. Salting addresses both by making each hash unique and defeating precomputation. MD5 remains irreversible, length extension is a separate issue, and salting does not significantly affect hash speed.