Desktop

Ask something
Question Locked

Questions ON Security

0 helpful
12 replies

by gbolaa

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Information available to you to is PIX ?informational? logging from a syslog sever. Standard internet access with caching DNS service is also available during your investigation.

For each scenario below, describe in detail, the technical steps and conclusion you reach for each scenario.

1. You notice an unusual spike in TCP and UDP flows from a single internal source to multiple destinations. Describe in detail the steps you would take to determine the type of traffic that this represents.

2. You have observed TCP connections to an IP address. The HTTP connections return a file named a.txt but when you try to retrieve the file with your browser you receive a 404 error code. You do not know the DNS name associated with the IP address (there is no reverse map). Describe the steps you would take to retrieve a.txt. Provide a plausible explanation why another machine on your network is retrieving a.txt but you are not able to do the same.

3. You are presented with a list of known bad DNS names but are not allowed to monitor traffic with network sniffers. You are asked to indicate what names are in use on your network without using a network sniffer. Describe, in detail the steps you would take.

4. You receive a report that an attacker from the external Internet has connected inbound via port 443 to remotely control a host on your internal network but you know the firewall blocks inbound connections. Do your best to explain possible reasons for activity.

5. A user reports that although he was logged into a web application at the time, he did not conduct the transaction that the web application purports. We know conclusively that the login has not been shared. What are some possible causes and what you do to investigate them?

12 replies

by wizard-09

You would run a program called WireShark, let someone else jump to answer number 2.

Keep us informed as to your progress if you require further assistance.

If you think that any of the posts that have been made by all TR Members, have solved or contributed to solving the problem, please Mark them as Helpful so that others may benefit from the outcome.

by wizard-09

You would run the command ping -a with the ip address to find the DNS name thats it childs play this is im off do your own home work :p

Keep us informed as to your progress if you require further assistance.

If you think that any of the posts that have been made by all TR Members, have solved or contributed to solving the problem, please Mark them as Helpful so that others may benefit from the outcome.

by robo_dev

that along with Ping would figure that one out.

Number 4: a trojan application on a Windows PC has 'phoned home'. A connection intiated inside the firewall is considered an outbound connection.

Number 5: Man in the middle attack, keystroke logger, malware.

You review webserver logs to identify source IP of transaction entry as well as time-of-day or other evidence that would indicate that another user had entered the transaction with stolen credentials.

If this helped you to get your homework turned in on-time, mark this post 'helpful' :)

by wizard-09

All completed by someone else hence you have no true knownledge of what it all means so lookup what was said in the forms and learn abit more about what each one does and how it works.

by bizzo

1. Pick up phone, dial the number for your network administrator, and ask them to check out the spikes.
2. Email the owner of the website and ask them to email you the file.
3. Make sure that all the network goes though one piece of cable, then very carefully remove the plastic insulation and replace with clear cling-film/food-wrap etc. This will allow you to actually see the wires to see what's being thent through them. Make sure you have a pen to write down the names that go through, they're really fast!
4. Your firewall is faulty, it needs replacing.
5. The user is a liar, he actually did conduct the transaction and is trying to scam the credit card company. Call the police and get a warrant to search his property. I'm sure you'll find those dozen blow up sheep.

by robo_dev

well said, well said

www.adultsheepfinder.com

Number 4 reminds me of the Dilbert cartoon where he tells the boss the network problems are because the firewall is getting too hot.

by gbolaa

Be serious-you probably will be doing okay if you check with comedy central tech.

by bizzo

Somewhere on your hands, usually opposite your pinky.

This discussion is closed to new replies.