🔒AP Cybersecurity
1. The following sources all come from the same device (IP address 192.168.50.10) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | ALL | 192.168.50.10 | Inbound | 22 | SSH |
2 | Allow | ALL | 192.168.50.10 | Inbound | 23 | Telnet |
3 | Allow | ALL | 192.168.50.10 | Inbound | 443 | HTTPS |
4 | Allow | 10.0.0.0/8 | 192.168.50.10 | Inbound | 8080 | HTTP |
5 | Allow | ALL | ALL | Outbound | 53 | DNS |
6 | Allow | ALL | ALL | Outbound | 123 | NTP |
7 | Allow | ALL | ALL | Outbound | 8883 | MQTT |
8 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — /home/iotadmin/.bash_history
sudo tail -n 12 /home/iotadmin/.bash_history
1 cd /opt/gateway
2 ls -la
3 cat device.conf
4 systemctl status edge-service
5 ping -c 4 8.8.8.8
6 ufw status numbered
7 apt-get update
8 apt-get upgrade -y
9 nano /etc/nginx/nginx.conf
10 systemctl restart nginx
11 tail -n 50 /var/log/auth.log
12 exitSource 3 — /var/log/auth.log
sudo tail -n 15 /var/log/auth.log
1 Nov 14 08:15:01 edge-iot sshd[2101]: Accepted publickey for iotadmin from 10.0.0.5 port 54321 ssh2
2 Nov 14 08:15:05 edge-iot sudo: iotadmin : TTY=pts/0 ; PWD=/home/iotadmin ; USER=root ; COMMAND=/bin/su
3 Nov 14 08:18:12 edge-iot telnetd[3401]: login: failed login for 'admin' from 198.51.100.73
4 Nov 14 08:18:13 edge-iot telnetd[3402]: login: failed login for 'admin' from 198.51.100.73
5 Nov 14 08:18:13 edge-iot telnetd[3403]: login: failed login for 'root' from 198.51.100.73
6 Nov 14 08:18:14 edge-iot telnetd[3404]: login: failed login for 'root' from 198.51.100.73
7 Nov 14 08:18:14 edge-iot telnetd[3405]: login: failed login for 'iotadmin' from 198.51.100.73
8 Nov 14 08:18:15 edge-iot telnetd[3406]: login: failed login for 'iotadmin' from 198.51.100.73
9 Nov 14 08:18:15 edge-iot telnetd[3407]: login: failed login for 'user' from 198.51.100.73
10 Nov 14 08:18:16 edge-iot telnetd[3408]: login: failed login for 'user' from 198.51.100.73
11 Nov 14 08:18:16 edge-iot telnetd[3409]: login: failed login for 'guest' from 198.51.100.73
12 Nov 14 08:18:17 edge-iot telnetd[3410]: login: failed login for 'guest' from 198.51.100.73
13 Nov 14 08:19:05 edge-iot kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:1A:2B:3C:4D:5E SRC=198.51.100.73 DST=192.168.50.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41234 PROTO=TCP SPT=45123 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
14 Nov 14 08:19:08 edge-iot kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:1A:2B:3C:4D:5E SRC=198.51.100.73 DST=192.168.50.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=41235 PROTO=TCP SPT=45123 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
15 Nov 14 08:25:33 edge-iot sshd[3502]: Connection closed by authenticating user iotadmin 10.0.0.5 port 54321 [preauth]Source 4 — /var/log/nginx/access.log
sudo tail -n 8 /var/log/nginx/access.log
1 10.1.2.3 - - [14/Nov/2025:09:20:05 +0000] "GET /api/status HTTP/1.1" 200 512 "-" "Mozilla/5.0"
2 10.1.2.3 - - [14/Nov/2025:09:21:12 +0000] "POST /api/telemetry HTTP/1.1" 201 128 "-" "IoT-Client/1.0"
3 203.0.113.88 - - [14/Nov/2025:09:22:10 +0000] "GET /api/download?file=../../../../etc/passwd HTTP/1.1" 200 1024 "-" "curl/7.68.0"
4 203.0.113.88 - - [14/Nov/2025:09:22:11 +0000] "GET /api/download?file=../../../../etc/shadow HTTP/1.1" 403 256 "-" "curl/7.68.0"
5 203.0.113.88 - - [14/Nov/2025:09:22:12 +0000] "GET /api/download?file=../../../../opt/gateway/device.conf HTTP/1.1" 200 1024 "-" "curl/7.68.0"
6 203.0.113.88 - - [14/Nov/2025:09:22:13 +0000] "GET /api/download?file=../../../../opt/gateway/mqtt_certs.pem HTTP/1.1" 403 256 "-" "curl/7.68.0"
7 10.1.2.3 - - [14/Nov/2025:09:25:00 +0000] "GET /api/status HTTP/1.1" 200 512 "-" "Mozilla/5.0"
8 10.1.2.3 - - [14/Nov/2025:09:26:45 +0000] "POST /api/telemetry HTTP/1.1" 201 128 "-" "IoT-Client/1.0"Source 5 — ls -l /opt/gateway
ls -l /opt/gateway
-rw-r--r-- 1 iotadmin iotadmin 8192 Nov 12 10:05 cache.dat
-rw-rw-r-- 1 iotadmin iotadmin 1024 Nov 12 09:14 device.conf
-rw-r--r-- 1 iotadmin iotadmin 3450 Nov 12 10:15 diagnostics.log
drwxr-xr-x 2 iotadmin iotadmin 4096 Nov 12 10:00 logs
-rw------- 1 iotadmin iotadmin 2048 Nov 12 09:14 mqtt_certs.pem
-rw-r--r-- 1 iotadmin iotadmin 256 Nov 12 09:14 readme.txt
-rwxr-xr-x 1 iotadmin iotadmin 512 Nov 12 09:14 start_gateway.sh
-rw-r--r-- 1 root root 1500000 Nov 10 11:22 update_firmware.binSource 6 — Acceptable Use Policy
Keep device firmware updated to the latest vendor release.
Change default credentials upon initial setup.
Connecting approved diagnostic peripherals via USB during maintenance windows.
Modifying firewall rules without change-board approval.
Connecting unauthorized removable media.
Disabling logging services.
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log, there is evidence of a password attack in rows 3–12.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider all the sources from the device.
Explain how the permission settings for one file in the /opt/gateway directory determine the level of access for that file for the owner, group, and all other users on the system. Include the name of the file in your response.
Other than removing all permissions from all users, describe one way the permission settings for one file on the system could be configured to restrict access for some users on the device. Include the name of the file in your response.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider all the sources from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device. Consider all the sources from the device.
Determine the type of attack evidenced in a log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
00:00
