Dr.

SNS RAJALAKSHMI COLLEGE OF ARTS AND SCIENCE

COIMBATORE-49
DEPARTMENT OF COMPUTER APPLICATIONS
SCHEMA OF EXAMINATION-NOVEMBER -2018
Course Name : Generic Cluster Elective –I: CYBER SECURITY
Course Code : 16UCU702 Prepared By : Ms.P.Shivaranjani

SECTION –A (15*1=15)

1. c) Cyber security

2. b) Network Vulnerability and port

3. b) Open, half-open, closed

4. d) all the above

5. a) SQL

6. d) Vulnerability

7. a) Internet connect machines

8. d) Denial of services

9. c) Firewall

10.a) Malware

11. d) Worm

12. c) Computer Forensics

13. d) Unauthorized Access

14. a) Spyware

15. c) Steganography

SECTION –B (5*3=15)

16. a) Vulnerability Probe

Some security bugs can’t be identified without sending a payload that exploits a suspected
vulnerability. These types of probes are more accurate—they rely on direct observation as opposed to
inferring problems based on port numbers or service banners. But they also carry more risk of interrupting the
service, because the test payload must be trying to either produce or take advantage of an error in the service’s
code.
 16.b) Netcat in Network Communications

Netcat performs a narrow function with a broad application to hacking and network debugging: it
reads and writes data for TCP and UDP connections. Netcat enables you to redirect shell commands across a
network. It’s a cat command for networking, with capabilities limited only by imagination. Netcat interacts
directly with a TCP or UDP service. You can inspect the raw data sent by a service, manually interact with the
service, or redirect network connections with stdin, stdout, or stderr.

17.a) Firewall and Compare packet filter Vs Firewall

Network security devices like firewalls can protect one system or one million systems (yes, the
number of connected devices on some of today’s networks is surpassing six digits). The term packet filter
refers to software that makes decisions based on protocol attributes: addresses, ports, and flags. Packet
filtering provides coarse (but effective) security to a network routing device. However, the software is
simplistic because the access control is limited to a handful of protocols like TCP/IP, UDP, and ICMP. The
term firewall is usually reserved for software or devices whose primary purpose is to apply security decisions
to network traffic.

17.b) Virtual Private Networks

Virtual Private Networks (VPNs) are a complex subject in terms of identity, authentication, and
encryption. We touch on them here because so many firewall and networking devices provide some degree of
VPN capability. In essence, a VPN establishes an encrypted channel between two networks (or single systems,
or a combination thereof) that is overlaid on a public network. It’s designed to mitigate the impact of using a
hostile network like a public Wi-Fi connection where data may be sniffed or intercepted by an attacker.

18.a) Nikto and W3af

Nikto, by Chris Sullo and David Lodge, is a Perl-based scanner that searches for known
vulnerabilities in common web applications, looks for the presence of common files that have the potential to
leak information about an application or its platform, and probes a site for indicators of common
misconfigurations.

w3af (web application attack and audit framework) is an open-source web application security
scanner. The project provides a vulnerability scanner and exploitation tool for Web applications.[1] It provides
information about security vulnerabilities for use in penetration testing engagements.

18. b) Curl and OpenSSL

Curl Where Netcat deserves bragging rights for being a flexible, all-purpose network tool, curl
deserves considerable respect as a flexible tool for HTTP connections. It consists of a command-line tool
(which is the focus of this section) and a high-performance, cross-platform, open source library.

OpenSSL The S in HTTPS represents the security (Secure Sockets Layer) provided for the connection
used to transport data; SSL establishes confidentiality by preventing eavesdroppers from sniffing the plaintext
traffic and provides integrity by establishing a trusted identity of the web server to prevent intermediation
attacks that try to manipulate traffic without being detected.

19.a) Digital Forensics

Digital forensics (sometimes known as digital forensic science) is a branch of forensic science
encompassing the recovery and investigation of material found in digital devices, often in relation to
computer crime. Aspiring forensic computer analysts typically need a bachelor's degree in a field such
as digital forensics, computer forensics, or computer security.

19.b) Contaminants and destruction of data

The Indian Legislature doesn’t provide the exact definition of Cyber crime in any statute, even the
Information Technology Act, 2000; which deals with cyber crime doesn’t defined the term of cyber crime.
However in general the term cybercrime means any illegal activity which is carried over or with the help of
internet or computers.

20. a) Steganography and DOS Attack

Steganography : The art and science of writing hidden messages in such a way that no one, apart
from the sender and intended recipient, suspects the existence of the message An image file may contain
hidden messages between terror groups, which will be known only to the intended recipient and the sender.

DOS Attack : Denial of service (DOS) and distributed denial of service (DDOS) attacks are tools
used by hackers to disrupt online services. The implications of these attacks can be wild – sometimes costing
bigger companies millions of dollars. If you run a business that is potentially a target for one of these attacks,
or if you’re just interested in the subject, read on for ways to defend yourself from these types of attacks.

20.b) SQL Injection and Buffer overflow

SQL Injection: SQL Injection is an attack that poisons dynamic SQL statements to comment out
certain parts of the statement or appending a condition that will always be true. It takes advantage of the
design flaws in poorly designed web applications to exploit SQL statements to execute malicious SQL code.

Buffer overflow: A buffer is a temporary area for data storage. When more data (than was originally
allocated to be stored) gets placed by a program or system process, the extra data overflows. It causes some of
that data to leak out into other buffers, which can corrupt or overwrite whatever data they were holding.

SECTION –B (5*3=15)

21.a) Function of Metasploit system in vulnerability scanning

Metasploit system be used to create security testing tools and exploit modules and also as a
penetration testing system. It was originally created as a portable network tool in 2003 by HD Moore.
Metasploit also offers a payload database, allowing the pen tester to mix and match exploit code and
objectives. Metasploit is used for hacking into systems for testing purposes. Metasploit provides
useful information to people who perform penetration testing, IDS signature development, and
exploit research. Vulnerability scanning will allow you to quickly scan a target IP range looking for
known vulnerabilities, giving a penetration tester a quick idea of what attacks might be worth
conducting. When used properly, this is a great asset to a pen tester, yet it is not without it’s draw
backs. Vulnerability scanning is well known for a high false positive and false negative rate. This has
to be kept in mind when working with any vulnerability scanning software.

21.b) Implementation and functioning of ettercap and Kismet in network sniffer and
injection

Kismet is an open source wireless network analyzer running under the Linux, Unix and Mac
OS X systems. It is able to detect any 802.11 a/b/g wireless networks around it. 802.11 a/b/g
protocols are WLAN (Wireless Local Area Network) standards. Kismet works with a lot of wireless
cards supporting "monitor" mode.

Ettercap is a tool made by Alberto Ornaghi (ALoR) and Marco Valleri (NaGA) and is
basically a suite for man in the middle attacks on a LAN. For those who do not like the Command
ike Interface (CLI), it is provided with an easy graphical interface. Ettercap is able to perform
attacks against the ARP protocol by positioning itself as "man in the middle" and, once positioned as
this, it is able to:

- infect, replace, delete data in a connection

- discover passwords for protocols such as FTP, HTTP, POP, SSH1, etc ...
- provide fake SSL certificates in HTTPS sections to the victims.

- Plugins are also available for attacks such as DNS spoofing.

22 a) Firewall function, stateless, state full firewall and windows firewall

A stateless firewall examines individual packets in isolation from each other; it doesn’t track
whether related packets have arrived before or are coming after. A stateful firewall places that packet
in the context of related traffic and within a particular protocol, such as TCP/IP or FTP. This enables
stateful firewalls to group individual packets together into concepts like connections, sessions, or
conversations. Consequently, a stateful firewall is able to filter traffic based not only on a packet’s
characteristics, but also on the context of a packet according to a session or conversation. For
example, a TCP ACK packet will be denied if the protected service hasn’t set up the SYN and SYN-
ACK handshake to establish a connection. Stateful firewalls also allow for more dynamic rulesets.
For example, suppose a system on the internal 192.168.1.0/24 network wanted to connect to a web
server on the Internet.

22. b) Installation and implementation of an intrusion detection system-snort

Firewalls block traffic that we know beforehand shouldn’t be traversing a protected network.
However, we have to let some traffic into the network, and, of course, traffic needs to go out. A
competent administrator creates a robust ruleset to prevent malicious traffic from bypassing a
firewall. A savvy administrator prepares for scenarios in which malicious traffic manages to bypass
the firewall. This is where network monitoring comes in. At its core, an intrusion-detection system
(IDS) is a sniffer like tcpdump or Wireshark, but with specialized filters that attempt to identify
malicious activity. A good IDS can find anything from a buffer overflow attack against an SSH
server to the transmission of /etc/password files over FTP.

23.a) Application of Inspection Tools:

The platform needs to start out secure so that it doesn’t weaken the code above. But the
platform is usually a small part of the application—at least from the end user’s perspective. A web
application’s platform may consist of tens of thousands of web servers connected to massive data
stores, but if it only exposes ports 80 and 443 to the user, and the application’s document root (the
location of its web pages) is locked down, then there’s very little of the platform for an attacker to
target. So, the attacker targets the application’s behavior instead.
 23. b) Password Checking and Brute –Force Tools.

Password cracking is the process of guessing or recovering a password from stored locations
or from data transmission system. It is used to get a password for unauthorized access or to recover a
forgotten password. In penetration testing, it is used to check the security of an application.

Brute-force attack when an attacker uses a set of predefined values to attack a target and
analyze the response until he succeeds. Success depends on the set of predefined values. If it is
larger, it will take more time, but there is better probability of success. The most common and easiest
to understand example of the brute-force attack is the dictionary attack to crack the password.

24.a) Cyber Crime, Hacking, Cyberspace and criminal behaviour:

Definition of Cyber Crime : The early 1970ties. He served as a Senior Computer Security
Consultant at the SRI International (Stanford Research Institute), and was the main author of the first
basic federal manual for law enforcement in the USA: ̳Computer Crime – Criminal Justice Resource
Manual‘ (1979). This manual became so on an encyclopedia also for law enforcement outside US.

Hacking : vector Hacking is technique in which, any one can access any one’s computer
without his permission. The Process of attempting to gain or successfully gaining, unauthorized
access to computer resources for the purpose of help or secure system is called Hacking. Reason for
hacking are 1.Destroy enemy’s computer network.2.Steal important information. 3.Notify many
people their thought.4.Hack other systems secretly. 5.Show off. 6.Just for fun.

Cyberspace : Most of us have a limited knowledge of "Cyberspace" and the crime occurring
in "cyberspace", known as cybercrime

24. b) Traditional problems associated with Computer Crime and Realm of cyber world
:

"Cyberspace" is a very wider term. Most of us have a limited knowledge of "Cyberspace" and
the crime occurring in "cyberspace", known as cybercrime, which happens on computer and the
Internet, however, cybercrime has a severe potential for remarkable impact on the lives of individuals
and our society. Therefore, a detailed introduction of cybercrime needs to be understood cybercrime
has three categories:

1. Target cybercrime: the crime in which a computer is the target of the offense.

2. Tool cybercrime: the crime in which a computer is used as a tool in committing the
offense.

3. Computer incidental: the crime in which a computer plays a minor role in committing the
offense.

For any business today, the reality of day-to-day functioning and management involves mass-
communication, networking, marketing, and the organization of important confidential information
on secured computer networks. Digitalization of information and communication is becoming
second-nature due to the efficiency and simplicity that computers provide, as well as their
instantaneity. However, as the amount of important and confidential information being stored on
computer networks continues to grow, so does the risk of becoming an appealing target for
scammers, fraudsters and cybercriminals.

25.a) Firewall, packet filters and password cracking

Packet filtering is a firewall technique used to control network access by monitoring

outgoing and incoming packets and allowing them to pass or halt based on the source and
destination Internet Protocol (IP) addresses, protocols and ports.

Passwords Cracking Passwords are a system designed to provide authentication. There are
many different ways to authenticate users of a system: a user can present a physical object like a key
card, prove identity using a personal characteristic like a fingerprint, or use so meting that only the
user knows. In contrast to the other approaches listed, a primary benefit of using authentication
through a password is that in the event that your password becomes compromised it can be easily
changed.

25.b) Spyware, virus, worms, Trojan and backdoors

Spyware is software that aims to gather information about a person or organization

sometimes without their knowledge, that may send such information to another entity without the
consumer's consent, that asserts control over a device without the consumer's knowledge, or it may
send such information to another entity with the consumer's consent, through cookies . "Spyware" is
mostly classified into four types: adware, system monitors, tracking cookies, and trojans;

A Trojan horse is a program that allows the attack to control the user’s computer from a
remote location. The program is usually disguised as something that is useful to the user. Once the
user has installed the program, it has the ability to install malicious payloads, create backdoors,
install other unwanted applications that can be used to compromise the user’s computer, etc.

A worm is a malicious computer program that replicates itself usually over a computer
network. An attacker may use a worm to accomplish the following tasks;

Virus is a computer program that attaches itself to legitimate programs and files without the
user’s consent. Viruses can consume computer resources such as memory and CPU time.

A backdoor is a method, often secret, of bypassing normal authentication or encryption in a

computer system, a product, or an embedded device (e.g. a home router), or its embodiment, e.g. as
part of a cryptosystem, an algorithm, a chipset, or a "homunculus computer" —a tiny computer-
within-a-computer