IAS Prelims Part 2

bluetooth

a wireless technology that allows devices to share data over short distances, and is vulnerable to various types of atacks

• discoverable

• limited discoverable

• non-discoverable

bluetooth operates in the following 3 discoverable modes:

discoverable

a bluetooth discoverable mode, devices are visible to other bluetooth-enabled devices. is necessary only while connecting to a device for the first time, since upon saving the connecting, the devices remember each other

limited discoverable

a bluetooth discoverable mode, devices are discoverable only for a limited period, for a specific event, or during temporary conditions. filters out non-matched IACs and reveals itself only to those that matched

had no host controller interface (HCI) to set a device directly in the limted discoverable mode, and a user has to do this indirectly

non-discoverable

a bluetooth discoverable mode, prevents the device from appearing on the list during a bluetooth-enabled device search process. remains visible to users and devices that were previously paired with it or know its MAC address

bluetooth hacking

the exploitation of bluetooth stack implementation vulnerablities to compromise sensitive data in bluetooth-enabled devices and networks

piconets

bluetooth-enabled devices connect and communicate wirelessly through ad-hoc networks known as what?

bluesmacking

a bluetooth device attack, occurs when an attacker sends an oversized ping packet to a victim’s device, causing a buffer overflow. similar to ICMP ping of death attack

bluejacking

a bluetooth device attack, the use of bluetooth to send messages to users without the recipient’s consent, similar to email spamming. does not cause any damage but is disruptive to the victims

bluesnarfing

a bluetooth device attack, method of gaining access to sensitive data in a bluetooth enabled device.

bluesniff

a bluetooth device attack, a proof-of-concept code for a bluetooth wardriving utility, useful for finding hidden and discoverable bluetooth devices and operates on linux

bluebugging

a bluetooth device attack, attacker gains remote access to a target bluetooth-enabled device without the victim’s awareness. attacker sniffs information and might perform malicious activities such as interpreting and forwarding phone calls and messages

blueprinting

a bluetooth device attack, performed to determine the make and model of a target bluetooth-enabled device. attacker collects info to creat infographics of the model, manufacturer, etc. to analyze for vulnerabilities

btlejacking

a bluetooth device attack, detrimental to bluetooth low energy (BLE) devices. attacker can sniff and take control of data transmission between BLE devices by performing MITM attack

key negotiation of bluetooth (KNOB) attack

a bluetooth device attack, enables attacker to breach bluetooth security mechanisms and perform and MITM attack on paired devices without being traced. detrimental to 2 bluetooth enabled devices sharing encrypted keys

MAC spoofing attack

a bluetooth device attack, passive attack in which attackers spoof the MAC address of a target bluetooth enabled device to intercept or manipulate the data sent to the target device

man in the middle/impersonation attacks

a bluetooth device attack, attackers manipulate the data transmitted between devices communicating via a bluetooth connection (piconet). devices intended to pair with one another unknowingly pair with the attacker’s device

cisco adaptive wireless intrusion detection system

offers advanced network security for dedicated monitoring and detection of wireless network anomalies, unauthorized access, and RF attacks

• AirMagnet WiFi analyzer PRO

• RFProtect

• WatchGuard WIPS

• AirMagnet Planner

• Extreme AirDefense

these are 5 additional wireless security tools

AirMagnet WiFi Analyzer PRO

an additional wireless security tools, professional tool that audits network performance, detects connectivity issues, and identifies security vulnerabilties in real time

RFProtect

an additional wireless security tools, Aruba Networks’ built-in WIPS that protects against rogue APs, MITM attacks, and unauthorized WiFi devices

WatchGuard WIPS

an additional wireless security tools, provides continuous monitoring, rogue AP detection, and automated wireless threat mitigation

AirMagnet Planner

an additional wireless security tools, allows network engineers to design optimal wireless coverage, predict signal strength, and plan AP placement before deployment

Extreme AirDefense

an additional wireless security tools, enterprise-grade WIPS and wireless monitoring platform that provides centralized detection, alerting, and response to wireless threats

phishing

a browser-based attack, redirects users to fake web pages that mimic trustworthy sites, asking them to submit their personal information

framing

a browser-based attack, involves a webpage integrated into another webpage using the iFrame elements of HTML

clickjacking

a browser-based attack, used to trick web users into clicking something different from what they think they are clicking

man-in-the-mobile

a browser-based attack, attacker implants malicious code into the victim’s mobile device to bypass password verification systems that send OTPs via SMS or voice calls

buffer overflow

a browser-based attack, abnormality whereby a program, while writing data to a buffer, surfeits the intended limit and overwrites the adjacent memory, resulting in erratic program behavior

data caching

a browser-based attack, pertains to parts of mobile devices that store information that is often required to interact with web applications, thereby preserving scarce resources and resulting in better response time for client applications

attackers attempt to exploit these to access the sensitive information stored in them

baseband attacks

a phone/SMS-based attack, attackers exploit vulnerabilities in a phone’s GSM/3GPP baseband processor, which sends and receives radio signals to cell towers

SMIShing

a phone/SMS-based attack, attacker uses SMS to send text messages containing deceptive links to malicious websites or telephone numbers to a victim

sensitive data storage

an application-based attack, some apps installed and used by mobile users employ weak security in their database architecture, which makes them targets for attackers who seek to hack and steal the sensitive user information stored in them

no encryption/weak encryption

an application-based attack, apps that transmit unencrypted or weakly encrypted data are susceptible to attacks such as session hijacking

improper SSL validation

an application-based attack, security loopholes in an application’s SSL validation process may allow attackers to circumvent the data security

configuration manipulation

an application-based attack, apps may use external configuration files and libraries that can be exploited in this attack. includes gaining unauthorized access to administration interfaces and configuration stores

dynamic runtime injection

an application-based attack, attackers manipulate and abuse the run time of an application to circumvent security locks and logic checks, access privileged parts of an app

unintended permissions

an application-based attack, misconfigured apps can sometimes open doors to attackers by providing this

escalated privileges

an application-based attack, take advantage of design flaws to gain access to resources that are usually protected from an application or user

no passcode/weak passcode

many users choose not to set a passcode or use a weak one, which an attacker can easily guess or crack to compromise sensitive data stored in the mobile device

iOS jailbreaking

process of removing security mechanisms set by Apple to prevent malicious code from running on the device

android rooting

allows android users to attain privileged control within android’s subsystem

OS data caching

since this specific part stores used data/information in memory temporarily on the hard disk, an attacker can dump this memory by rebooting the victim’s device with a malicious OS and extract sensitive data from the dumped memory

passwords and data accessible

iOS devices store encrypted passwords and data using cryptographic algorithms that have certain known vulnerabilities, in which attackers exploit to decrypt the device’s keychain and other private data