200-201 · Question #51
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine…
The correct answer is B. transport layer security encryption. If an analyst cannot determine the technique and payload from a packet capture of C2 communication, it strongly suggests the traffic is encrypted, making its contents unreadable.
Question
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication. Which obfuscation technique is the attacker using?
Exhibit
Options
- ABase64 encoding
- Btransport layer security encryption
- CSHA-256 hashing
- DROT13 encryption
How the community answered
(31 responses)- A6% (2)
- B71% (22)
- C3% (1)
- D19% (6)
Why each option
If an analyst cannot determine the technique and payload from a packet capture of C2 communication, it strongly suggests the traffic is encrypted, making its contents unreadable.
Base64 encoding is a simple encoding scheme that makes binary data text-safe, but it is not encryption and can be easily decoded to reveal the original payload.
Transport Layer Security (TLS) encryption, often referred to as SSL/TLS, encrypts the entire communication payload between the client and server, preventing an analyst from directly observing the technique or payload within a packet capture without decryption.
SHA-256 hashing is a one-way cryptographic function used for data integrity verification, not for obscuring communication content that needs to be transmitted and then revealed.
ROT13 encryption is a trivial substitution cipher that offers very weak security and would be easily deciphered, not preventing an analyst from determining the payload.
Concept tested: Network traffic obfuscation via encryption
Source: https://learn.microsoft.com/en-us/windows-server/security/tls/tls-ssl-protocol-overview
Topics
Community Discussion
No community discussion yet for this question.
