Rebecca is a security analyst and knows of a local root exploit that has the ability to enable local
users to use available exploits to gain root privileges. This vulnerability exploits a condition in the
Linux kernel within the execve() system call. There is no known workaround that exists for this
vulnerability. What is the correct action to be taken by Rebecca in this situation as a
recommendation to management?

What is Cygwin?

Ron has configured his network to provide strong perimeter security. As part of his network
architecture, he has included a host that is fully exposed to attack. The system is on the public
side of the demilitarized zone, unprotected by a firewall or filtering router. What would you call
such a host?

After studying the following log entries, what is the attacker ultimately trying to achieve as inferred
from the log sequence?
1. mkdir -p /etc/X11/applnk/Internet/.etc
2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd
3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd
4. touch -acmr /etc /etc/X11/applnk/Internet/.etc
5. passwd nobody -d
6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash

7. passwd dns -d
8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd
9. touch -acmr /etc/X11/applnk/Internet/.etc /etc

Clive is conducting a pen-test and has just port scanned a system on the network. He has
identified the operating system as Linux and been able to elicit responses from ports 23, 25 and
53. He infers port 23 as running Telnet service, port 25 as running SMTP service and port 53 as
running DNS service. The client confirms these findings and attests to the current availability of the
services. When he tries to telnet to port 23 or 25, he gets a blank screen in response. On typing
other commands, he sees only blank spaces or underscores symbols on the screen. What are you
most likely to infer from this?

On a backdoored Linux box there is a possibility that legitimate programs are modified or trojaned.
How is it possible to list processes and uids associated with them in a more reliable manner?

Peter is a Linux network admin. As a knowledgeable security consultant, he turns to you to look for
help on a firewall. He wants to use Linux as his firewall and use the latest freely available version
that is offered. What do you recommend?
Select the best answer.

Exhibit

Study the log given in the exhibit,
Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall
rules, which among the following would be appropriate?

You are attempting to map out the firewall policy for an organization. You discover your target
system is one hop beyond the firewall. Using hping2, you send SYN packets with the exact TTL of
the target system starting at port 1 and going up to port 1024. What is this process known as?

Once an intruder has gained access to a remote system with a valid username and password, the
attacker will attempt to increase his privileges by escalating the used account to one that has
increased privileges. such as that of an administrator. What would be the best countermeasure to
protect against escalation of priveges?