CAS-001 · Question #350
At 10:35 a.m. a malicious user was able to obtain a valid authentication token which allowed read/write access to the backend database of a financial company. At 10:45 a.m. the security…
The correct answer is D. A race condition has occurred. This is a race condition between the attacker's active authentication token and the administrative remediation action. The attacker obtained a valid authentication token at 10:35 AM. The security administrator reset the password at 10:55 AM, but password resets do not…
Question
At 10:35 a.m. a malicious user was able to obtain a valid authentication token which allowed read/write access to the backend database of a financial company. At 10:45 a.m. the security administrator received multiple alerts from the company's statistical anomaly-based IDS about a company database administrator performing unusual transactions. At 10:55 a.m. the security administrator resets the database administrator's password. At 11:00 a.m. the security administrator is still receiving alerts from the IDS about unusual transactions from the same user. Which of the following is MOST likely the cause of the alerts?
Options
- AThe IDS logs are compromised.
- BThe new password was compromised.
- CAn input validation error has occurred.
- DA race condition has occurred.
How the community answered
(50 responses)- A6% (3)
- B30% (15)
- C12% (6)
- D52% (26)
Explanation
This is a race condition between the attacker's active authentication token and the administrative remediation action. The attacker obtained a valid authentication token at 10:35 AM. The security administrator reset the password at 10:55 AM, but password resets do not automatically invalidate previously issued session tokens or authentication tokens that are already in use. The token the attacker holds remains valid until it expires or is explicitly revoked. At 11:00 AM, the attacker is still using that token to perform unauthorized transactions - the token and the password reset are racing, and the token's validity period has not yet elapsed. The correct remediation would have been to revoke/invalidate the specific token, not just reset the password.
Topics
Community Discussion
No community discussion yet for this question.