nerdexam
CompTIA

CAS-002 · Question #103

The security administrator at `company.com' is reviewing the network logs and notices a new UDP port pattern where the amount of UDP port 123 packets has increased by 20% above the baseline. The…

The correct answer is A. An NTP client side attack successfully exploited some hosts. The hosts sending NTP traffic to an external IP and showing an svchost.exe hash mismatch indicate those NTP clients were compromised through a client-side NTP exploit.

Research and Analysis

Question

The security administrator at `company.com' is reviewing the network logs and notices a new UDP port pattern where the amount of UDP port 123 packets has increased by 20% above the baseline. The administrator runs a packet capturing tool from a server attached to a SPAN port and notices the following. UDP 192.168.0.1:123 -> 172.60.3.0:123 UDP 192.168.0.36:123 -> time.company.com UDP 192.168.0.112:123 -> 172.60.3.0:123 UDP 192.168.0.91:123 -> time.company.com UDP 192.168.0.211:123 -> 172.60.3.0:123 UDP 192.168.0.237:123 -> time.company.com UDP 192.168.0.78:123 -> 172.60.3.0:123 The corporate HIPS console reports an MD5 hash mismatch on the svchost.exe file of the following computers:

192.168.0.1 192.168.0.112 192.168.0.211 192.168.0.78 Which of the following should the security administrator report to upper management based on the above output?

Options

  • AAn NTP client side attack successfully exploited some hosts.
  • BA DNS cache poisoning successfully exploited some hosts.
  • CAn NTP server side attack successfully exploited some hosts.
  • DA DNS server side attack successfully exploited some hosts.

How the community answered

(62 responses)
  • A
    66% (41)
  • B
    19% (12)
  • C
    5% (3)
  • D
    10% (6)

Why each option

The hosts sending NTP traffic to an external IP and showing an svchost.exe hash mismatch indicate those NTP clients were compromised through a client-side NTP exploit.

AAn NTP client side attack successfully exploited some hosts.Correct

The four hosts with svchost.exe MD5 hash mismatches (192.168.0.1, .112, .211, .78) are exactly the hosts redirecting UDP port 123 traffic to the external IP 172.60.3.0 rather than the internal time.company.com server. This correlation shows those NTP client hosts were exploited - malware modified svchost.exe and redirected their time synchronization traffic, which is the signature of a successful client-side NTP attack.

BA DNS cache poisoning successfully exploited some hosts.

DNS cache poisoning targets port 53 traffic and would manifest as abnormal DNS resolution behavior, not elevated UDP port 123 NTP packet counts.

CAn NTP server side attack successfully exploited some hosts.

A server-side NTP attack would compromise the NTP server (time.company.com) itself; here the internal server appears unaffected while individual client workstations show the compromise indicators.

DA DNS server side attack successfully exploited some hosts.

There is no evidence of anomalous DNS traffic or DNS server behavior; all indicators - port 123, NTP redirects, and client hash mismatches - point exclusively to NTP as the attack vector.

Concept tested: NTP client-side attack detection via traffic analysis and host integrity

Source: https://www.cisa.gov/news-events/alerts/2014/04/25/ntp-amplification-attacks-using-cve-2013-5211

Topics

#NTP#packet analysis#anomaly detection#network forensics

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice