🔒AP Cybersecurity
1. The following sources all come from the same device (IP address 10.50.2.100) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | 10.50.2.0/24 | ALL | Inbound | 22 | SSH |
2 | Allow | ALL | ALL | Inbound | 3389 | RDP |
3 | Allow | ALL | ALL | Inbound | 8080 | HTTP |
4 | Allow | ALL | ALL | Outbound | 80 | HTTP |
5 | Allow | ALL | ALL | Outbound | 443 | HTTPS |
6 | Allow | ALL | ALL | Outbound | 53 | DNS |
7 | Allow | 10.50.2.0/24 | ALL | Inbound | 5432 | PostgreSQL |
8 | Deny | ALL | ALL | Inbound | 23 | Telnet |
9 | Deny | ALL | ALL | Inbound | 21 | FTP |
10 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — ~/.bash_history
sudo tail -n 12 /home/arivera/.bash_history
1 cd /home/arivera/projects/webapp
2 ls -la
3 nano index.html
4 systemctl status xrdp
5 sudo ufw status
6 git pull origin main
7 npm install
8 npm run dev
9 curl localhost:8080
10 htop
11 ping 8.8.8.8
12 clearSource 3 — /var/log/auth.log
sudo tail -n 10 /var/log/auth.log
1 Oct 14 09:12:01 dev-workstation sudo: arivera : TTY=pts/0 ; PWD=/home/arivera ; USER=root ; COMMAND=/usr/sbin/ufw status
2 Oct 14 09:15:22 dev-workstation kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:1A:2B:3C:4D:5E SRC=198.51.100.73 DST=10.50.2.100 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41234 PROTO=TCP SPT=49152 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
3 Oct 14 09:18:05 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=admin
4 Oct 14 09:18:06 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=admin
5 Oct 14 09:18:07 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=root
6 Oct 14 09:18:08 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=arivera
7 Oct 14 09:18:09 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=arivera
8 Oct 14 09:18:10 dev-workstation xrdp-sesman[1120]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp ruser= rhost=198.51.100.73 user=test
9 Oct 14 09:22:15 dev-workstation sshd[2045]: Accepted publickey for arivera from 10.50.2.45 port 50332 ssh2
10 Oct 14 09:22:15 dev-workstation sshd[2045]: pam_unix(sshd:session): session opened for user arivera by (uid=0)Source 4 — /var/log/nginx/access.log
sudo tail -n 6 /var/log/nginx/access.log
1 10.50.2.45 - - [14/Oct/2024:10:01:12 -0400] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"
2 10.50.2.45 - - [14/Oct/2024:10:01:15 -0400] "GET /assets/style.css HTTP/1.1" 200 512 "http://10.50.2.100/" "Mozilla/5.0"
3 203.0.113.88 - - [14/Oct/2024:10:05:33 -0400] "GET /api/download?file=../../../../etc/passwd HTTP/1.1" 403 153 "-" "curl/7.81.0"
4 203.0.113.88 - - [14/Oct/2024:10:05:35 -0400] "GET /api/download?file=../../../../etc/shadow HTTP/1.1" 403 153 "-" "curl/7.81.0"
5 203.0.113.88 - - [14/Oct/2024:10:05:38 -0400] "GET /api/download?file=../../../../var/www/html/config.php.bak HTTP/1.1" 404 135 "-" "curl/7.81.0"
6 10.50.2.45 - - [14/Oct/2024:10:10:02 -0400] "POST /api/login HTTP/1.1" 200 45 "-" "Mozilla/5.0"Source 5 — ls -l /home/arivera/projects/webapp
ls -l /home/arivera/projects/webapp
total 24
-rw-rw-rw- 1 arivera developers 512 Oct 12 09:15 app_config.env
drwxr-xr-x 2 arivera developers 4096 Oct 10 11:20 assets
-rwxr-x--- 1 arivera developers 1024 Oct 11 14:30 deploy.sh
-rw-r--r-- 1 arivera developers 2048 Oct 10 11:22 index.html
-rw-r--r-- 1 arivera developers 8192 Oct 13 16:45 main.js
drwxr-xr-x 3 arivera developers 4096 Oct 10 11:20 srcSource 6 — Acceptable Use Policy
Keep operating systems and development tools updated to the latest stable versions.
Use multi-factor authentication (MFA) for all remote access.
Connecting approved external monitors and peripherals.
Installing approved development frameworks.
Storing unencrypted credentials in world-readable or world-writable files.
Disabling host-based firewalls or endpoint detection tools.
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log (Source 3), there is evidence of a password attack.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider all the sources from the device.
Explain how the permission settings for one file in the /home/arivera/projects/webapp directory determine the level of access for that file for the owner, group, and all other users on the system. Include the name of the file in your response.
Other than removing all permissions from all users, describe one way the permission settings for one file on the system could be configured to restrict access for some users on the device. Include the name of the file in your response.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider all the sources from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device. Consider all the sources from the device.
Determine the type of attack evidenced in a log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
00:00
