CAS-003 · Question #646
An attacker exploited an unpatched vulnerability in a web framework, and then used an application service account that had an insecure configuration to download a rootkit. The attacker was unable to…
The correct answer is E. Perform regular uncredentialed vulnerability scans. The attacker's initial foothold came from an unpatched vulnerability in a web framework. The server was rebuilt and patched reactively after the incident. To proactively prevent a recurrence, regular uncredentialed vulnerability scans simulate what an external attacker sees and…
Question
An attacker exploited an unpatched vulnerability in a web framework, and then used an application service account that had an insecure configuration to download a rootkit. The attacker was unable to obtain root privileges Instead the attacker then downloaded a crypto- currency mining program and subsequently was discovered. The server was taken offline, rebuilt, and patched. Which of the following should the security engineer suggest to help prevent a similar scenario in the future?
Options
- ARemove root privileges from the application service account
- BImplement separation of duties.
- CProperly configure SELinux and set it to enforce.
- DUse cron to schedule regular restarts of the service to terminate sessions.
- EPerform regular uncredentialed vulnerability scans
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C15% (3)
- D20% (4)
- E55% (11)
Explanation
The attacker's initial foothold came from an unpatched vulnerability in a web framework. The server was rebuilt and patched reactively after the incident. To proactively prevent a recurrence, regular uncredentialed vulnerability scans simulate what an external attacker sees and can identify unpatched vulnerabilities before they are exploited. Uncredentialed scans are particularly important because they reflect the external attack surface without requiring authenticated access. Option A is a distractor - the attacker already failed to get root, so removing root from the service account wouldn't have changed the outcome. Option C (SELinux) would limit what the compromised service could do, but doesn't address the unpatched vulnerability that was the root entry point. Regular scanning is the most direct preventive control against the specific attack vector described.
Topics
Community Discussion
No community discussion yet for this question.