nerdexam
GIAC

GCIH · Question #27

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests…

The correct answer is A. The attack was social engineering and the firewall did not detect it. Adam used social engineering to lure employees to a deceptive internal webpage containing an embedded keylogger, and the firewall could not detect this because the malicious activity was carried over normal, user-initiated web traffic. The human element - not the network - was…

Web Application Attacks & Post-Exploitation

Question

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to test the network security of the company. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a company's icon to mark the progress of the test. Adam successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access. How was security compromised and how did the firewall respond?

Options

  • AThe attack was social engineering and the firewall did not detect it.
  • BSecurity was not compromised as the webpage was hosted internally.
  • CThe attack was Cross Site Scripting and the firewall blocked it.
  • DSecurity was compromised as keylogger is invisible for firewall.

How the community answered

(48 responses)
  • A
    71% (34)
  • B
    8% (4)
  • C
    4% (2)
  • D
    17% (8)

Why each option

Adam used social engineering to lure employees to a deceptive internal webpage containing an embedded keylogger, and the firewall could not detect this because the malicious activity was carried over normal, user-initiated web traffic. The human element - not the network - was exploited.

AThe attack was social engineering and the firewall did not detect it.Correct

The attack is classified as social engineering because Adam manipulated employees into voluntarily visiting and interacting with a seemingly legitimate webpage, which served as the delivery mechanism for the keylogger. Firewalls operate by filtering traffic based on ports, protocols, and rules, and cannot inspect or detect malicious intent embedded within allowed HTTP sessions initiated by legitimate users, so the firewall passed the traffic without alerting.

BSecurity was not compromised as the webpage was hosted internally.

Internal hosting does not eliminate security risk - the keylogger was embedded in the internally hosted page and could still capture and exfiltrate user credentials regardless of where the page was hosted.

CThe attack was Cross Site Scripting and the firewall blocked it.

Cross-Site Scripting (XSS) involves injecting malicious scripts into an existing trusted third-party website; Adam built and fully controlled the page himself, so this is social engineering, not XSS, and the firewall did not block it.

DSecurity was compromised as keylogger is invisible for firewall.

While it is true that keyloggers can evade firewall inspection, this answer fails to identify the social engineering attack vector and does not correctly characterize how security was compromised or why the firewall was unable to respond.

Concept tested: Social engineering attack delivery and firewall detection limitations

Source: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks

Topics

#keylogger#social engineering#firewall evasion#insider threat

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice