QUESTION 1
(a) Describe what a Turtle Shell Architecture is and give an instance.
(b) Briefly clarify the principle of least privilege using an appropriate instance.
(c) Judge the following block of codes underneath.
Include("db_connect.php")://handles database connection
$sql="INSERT
INTO users(reg_username,
Reg_password,
Reg_email)
VALUES(‘{$_POST[‘reg_username']}'
‘$reg_password'.
‘{$_POST[reg_email']})':
Mysql_close():
?>
Imagine that this query is creating a new account. The user gives a desired username and an email address. The registration application generates a temporary password and emails it to the user to verify the email address.
If a valid email address is given (jeff.shield@gmail.com, for example), and "hamp98" is what the application generates for the password.
Give explanation whether an SQL injection attack is possible. Explicate your reasoning with an appropriate example.
(d) Let's presume a query in a product detail page as follows:
$sql="SELECT*FROMproductWHEREproduct_id='".$_GET[‘product_id]."'";
Now an intruder inserts an SQL command in the URL of the page, the code is like this 10'; DROP TABLE product; # and the URL looks like this:
http://abcfoods.com/product.php?id=10'; DROP TABLE product; #
At this instant the query becomes this:
SELECT * FROM product WHERE product_id='10'; DROP TABLE product; #';
You might be doubting what the meaning of hash "#" is. It simply tells the MYSQL server to ignore the rest of the query.
Explain what happen when the URL is processed with the injection as shown above.
(e) Briefly portray four methods how confidentiality can be ensured.
(f) Jane wishes to transfer $100 to Bob using bank.com. The request generated by Jane will look similar to the subsequent:
POST http://bank.com/transfer.phpHTTp/1.1
....
....
....
Content-Length:19:
Acct=BOB&amount=100
On the other hand, Maria notices that the same web application will execute the same transfer using URL parameters as tag along:
GET http://bank.com/transfer.php?acct=100HTTP/1.1
Maria now made a decision to exploit this web application vulnerability using Jane as her victim. Maria has to construct the URL which will transfer $100,000 from Jane's account to her account.
(i) Create the above URL for Maria
At this instant that her malicious request is generated, Maria must trick Jane into submitting the request. The most basic method is to send Jane an HTML email containing the link and expect Jane to click on it.
Assuming Jane is authenticated with the application when she clicks the link, the transfer of $100,000 to Maria's account will occur. However, Maria realizes that if Jane clicks the link, then Jane will notice that a transfer has occurred. as a result, Maria come to a decision to hide the attack in a zero-byte image.
(ii) Write the code that Maria must send to Jane in the email making use of a zero-byte representation.
(iii) Describe using an appropriate example how bank.com can prevent such security vulnerability.
(g) Portray three types of biometric identification schemes.
QUESTION 2
(a) In essence security is holistic. Explain this reasoning using appropriate examples.
(b) All secure systems should aim at providing some security concepts. Explain seven of them.
(c) Explicate three ways to authenticate a user and give an example of a real world two-factor authentication.
(d) What is an Access Control List?
(e) Present two ways how webmasters can ensure maximum availability of their web applications.
(f) Describe what happen during a DNS Cache Poisoning attack.
QUESTION 3
(a) Tell apart symmetric and public key encryption cryptographic systems and their modes of operation.
(b) Describe what hash functions are and using a suitable example show how to Work out the hash on a string using MD5.
(c) Elucidate what you understand by the terms hash collision and rainbow tables giving an appropriate example for each. Also describe how they can be prevented.
(d) Mark a 16-pass iterative and 9-pass recursive PHP function using hash algorithm sha1 and salt "iamsexyandiknowit" to hash password "passwordcanon".