Module 3 - Attacks through Browsers and Add-on Modules

Question 1

Browser Vulnerabilities

Answer 1

• all have

- rely on users to upgrade to new versions and install patches

Question 2

Browser Helper Objects (BHOs)

Answer 2

• extend functionality of browser, e.g. open PDFs, render graphics, play movies
• popular as targets
• not patched as often as browsers

Question 3

Access via Browser

Answer 3

• intrusions launched through browsers and BHOs frequently have same level of permission as user account

Question 4

Browser Intrusion Artifacts (4)

Answer 4

• internet cache
• account temp directory
• Windows registry
• Java Runtime Environment (JRE) files

Question 5

Browser Attacks (method examples)

Answer 5

• exploit configurations
• change default home page
• install toolbar

Question 6

IE Home Page Setting

Answer 6

\Software\Microsoft\Internet Explorer\Main\Start Page

Question 7

IE Add-ons

Answer 7

Internet Options

Manage Add-Ons

Question 8

Safari Extensions

Answer 8

Preferences

Extensions

Question 9

Java Runtime Environment (definition)

Answer 9

runtime portion of Java software (only thing needed to run Java via web browser)

Question 10

JRE (parts)

Answer 10

• Java Virtual Machine (JVM)
• Java platform core classes
• Java platform libraries (supporting libraries)

Question 11

Java plug-in (definition)

Answer 11

• component of JRE
• allows applets written in Java to run inside browsers
• not standalone program -> cannot be installed separately.

Question 12

XSS

Answer 12

Cross Site Scripting (both client and server)

• loading attacked, 3rd party web app from unrelated attack site -> in manner that executes fragment of JavaScript prepared by attacker.
• now also other modes of code injection, including ActiveX, Java, VBScript, Flash, or HTML scripts

Question 13

XSS Persistent

Answer 13

• less common

- data (from attacker) saved by server and permanently displayed on “normal” pages without proper HTML escaping

Question 14

XSS non-persistent

Answer 14

• more common
• data provided by web client (HTML query parameters or form submissions) used by server-side scripts to parse and display results to user without properly sanitizing the request.

Question 15

Artifacts for XSS

Answer 15

• emails (for links)
• web page caches (for links)
• web server logs

Question 16

Locations of browser caches

Answer 16

in profiles

Question 17

Artifacts for BHOs

Answer 17

• registry (SOFTWARE\Classes\CSID ntuser.dat)

- JAR files (C:\Users\AppData\LocalLow\Sun\Java\Deployment\cache