Content Team - Questionnaire
Date: 11/11/03 - ram
0. General information:
If you think a question is not clear, you may make your own assumptions. If so, justify your assumptions clearly in your answer; For some questions, there maybe many correct answers, which may or may not be equally good.
1. Unix Shell Scripting:
1.1 Bash
Write a short bash-script to iterate over all the files in a directory, renaming them to xxx.old
I assume you mean files that do not begin with "." and that a subdirectory is not considered a file.
#! /bin/sh
cd /path/directory
(for i in *; do test -f $i && mv $i $i.old; done)
If you want to match all files except "." and "..", use this glob:
.[!.]* .??* *
1.2 sed
How do you convert a Windows-saved textfile into a UNIX textfile using sed?
I'm assuming you don't care about the terminating ctrl-Z (if any).
On BSD, this works: echo -ne '\015' | sed -e 's/[[:cntrl:]]//' | od -c
On Linux, this worked but relies on non-POSIX behavior: echo -ne '\015' | sed -e 's/\x0d//' | od -c
1.3 awk
Using awk, how do you extract only the process-id from a "ps aux" command?
ps -aux | awk -- '{ print $2 }' # using "ps aux" without a dash is deprecated IIRC, same with tar, backup &c.
2. SQL
Consider the following relational schema describing book and borrowers in a library:
# Entities
create table Book (
isbn integer, # primary key
title char(50),
publisher char(30),
year integer
)
create table Author(
isbn integer,
name string,
rank integer
# primary key (isbn,name)
# foreign key (isbn) references Book(isbn)
)
Assume that the Author.rank field specifies whether the author is the first, second, ... author.
Write a SQL-statement that returns all the Books written by authors named: "Meyer" or "Mayer".
I assume you want the ISBN of the books:
SELECT isbn from Author where name = "Meyer" or name = "Mayer";
3. Perl
3.1 Regular Expression
3.1.1 Why does the following regular expression not match the given input? Correct it!
RegEx: microsoft.*scid=kb;.+;[a-zA-Z]*(\d+)
Input: http://www.microsoft.com/knowledgebase.asp?scid=kb;forward=12;page=123;
It's missing the last equals sign: microsoft.*scid=kb;.+;[a-zA-Z]*=(\d+)
3.1.2 List the matched parts of the following reg-ex applied on the input line below:
RegEx: CERT\s+adviso.+(CA-\d+-\d+)
Input: CERT advisories CA-2003-16 and CERT advisory CA-1999-
The \s+ matches " ".
The .+ matches "ries "
The pattern in the parens matches "CA-2003-16".
3.1.3: What regular expression extracts the Event-ID (2000303) from the following input line?
advICE :Intrusions : 2000303
A simple one is " : (\d+)".
3.2 Database
What are the calls to open a DBI database connection in Perl and execute a simple query?
use DBI;
$dbh = DBI->connect($data_source, $username, $auth, \%attr);
$sth = $dbh->prepare("SELECT foo, bar FROM table WHERE baz=?");
$sth->execute( $baz );
while ( @row = $sth->fetchrow_array ) {
print "@row\n";
}
3.3 Arrays
Write a simple code snippet in Perl which iterates over an array and prints all the entries to stdout.
foreach (@array) { print "$_\n"; }
4. Security Knowledge
4.1 CVE
List the CVE IDs which are referencing the MS Blaster worm.
CAN-2003-0352 is about MS Blaster.
CAN-2003-0746 is about a DoS vuln that could be triggered by MS Blaster.
CAN-2003-0528, CAN-2003-0715, and CAN-2003-0813 reference it,
but only to distinguish themselves from it.
4.2 Vulnerability Mapping
For the CVE IDs found in 4.1, list all the corresponding IDs from arachNIDS, XForce, Bugtraq and Nessus.
I'm assuming that you mean just CAN-2003-0352. XXX FIXME do 0746 too
arachNIDS: their search engine can't find it right now - is it broken?
XF:win-rpc-dcom-bo(12629)
BID: 8205
Nessus: Buffer overrun in RPC interface (823980)
4.3 Travelling Laptop
One of our customers uses a host-based IDS on all of his employee's laptops. Simplyfied, the HIDS collects logs of the following form:
Date, SourceIP, DestinationIP, EventName
The logs are pulled into a central server each time the employee connects to the corporate network.
Do you see any problems in this approach? Outline them and provide a possible solution.
This question is very incomplete as I have to assume all kinds of things,
most notably what he's trying to accomplish, how he connects to the
corporate network (VPN?), if they have static IPs, etc.
If he is just trying to gather aggregate statistics on how often his machines
have been attacked, this has a few problems. Since the logs are not relayed
immediately, then an intruder has the opportunity to modify them before they
are sent. All future reports are subject to the intruder's control, but that
is obvious.
If he is trying to collect statistics on a per-machine basis, there are some
other problems. For one, a laptop may have different IPs if they are
dynamically assigned or if they attach to more than one network.
If he is trying to react to intrusions, waiting for connection to the
corporate network provides time for the attacker to cover his tracks,
to launch attacks other systems, to hide better by installing rootkits,
etc.
I think it would be a good idea to alert the user to hack attempts against
the laptop is using, and even more importantly to hack attempts *from* his
laptop. If that were the case he'd know it had been compromised and
hopefully would bring it in to be secured before connecting it to the
corporate network and thus potentially introducing a worm behind the
firewall.
4.4 Event Graph Interpretation
Have a look at the attached EventGraph. White boxes are targets. Blue boxes are sources and targets at the same time. The circles are event-categories.
What do you see in this graph? Remember, the answer is wide open and the graph might not show everything that is going on!
Can you be more specific? I see an intruder who has broken into three
machines (one by vector unspecified, one by vector not identified, and
one by exploiting transitive trust). He has tried to nmap machines on
five networks, and tried to launch a number of web-based attacks against
a single host, probably a web vuln scanner of some kind. Based on what
I can find about l3retriever, it suggests they are using L3's
(now Symantec's) scanner called "retriever".
4.5 Networking
Have a look at the attached network diagram (Interview-Network.jpg). Assume we place a sniffer on this subnet to dump all the packets on the ethernet segment. Assume further that the middle machine (Client) just started up and has no locally cached networking information.
What are the 9 packets you will see if the Client tries to open an ftp connection to "ftp://FileServer"?
This assumes that this is all ethernet and there's no rarp, dhcp, frags
or other complications.
1. ARP request "who has" 10.2.2.2 with source MAC=A and target MAC=FFFFFFFFFFFF
2. ARP response 10.2.2.2 is-at MAC=C with source MAC=C and target MAC=A
3. UDP DNS request from 10.1.0.1 to 10.2.2.2 for "FileServer"
4. UDP DNS reply from 10.2.2.2 to 10.1.0.1 for "FileServer" 10.2.99.99
5. ARP request "who has" 10.2.99.99 with source MAC=A and target MAC=FF...
6. ARP response 10.2.99.99 is-at MAC=B with source MAC=B and target MAC=A
7. TCP SYN from 10.1.0.1 to 10.2.99.99 with source MAC=A and target MAC=B
8. TCP SYN/ACK from 10.2.99.99 to 10.1.0.1 with source MAC=B and target MAC=A
9. TCP ACK from 10.1.0.1 to 10.2.99.99 with source MAC=A and target MAC=B
You do not have to provide all the details in the packets, but roughly show what the packets would look like.