Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

Match each observed technical indicator from packet captures and system logs to its corresponding network or wireless attack classification.

  • Frame captures reveal 802.1Q tagged traffic originating from an access port containing nested outer VLAN ID 10 and inner VLAN ID 20 headers.VLAN Hopping (Double Tagging)
  • Network logs show an unauthorized device responding to client broadcast DHCPDISCOVER messages with DHCP Option 3 pointing to a rogue gateway address.Rogue DHCP Server Attack
  • Packet inspection reveals unsolicited OBEX protocol transactions establishing an unauthenticated wireless connection to extract contact lists from a mobile device.Bluesnarfing
  • Audit logs indicate an anomalous propagation delay during ISO 14443 challenge-response authentication while exchanging credentials between a physical badge and an access control reader.RFID / NFC Relay Attack

Answer

VLAN double tagging frames correspond to VLAN Hopping; unauthorized gateway options in DHCP responses correspond to a Rogue DHCP Server Attack; unauthorized OBEX data extraction over Bluetooth corresponds to Bluesnarfing; anomalous ISO 14443 timing delays correspond to an RFID/NFC Relay Attack.
Each indicator uniquely aligns with its attack mechanism: nested 802.1Q headers represent Double Tagging VLAN Hopping; rogue default gateway assignments via DHCP Option 3 represent Rogue DHCP deployment; unauthorized data exfiltration via Bluetooth OBEX represents Bluesnarfing; and timing anomalies in ISO 14443 smart card authentication indicate an RFID/NFC Relay Attack.

Step-by-Step Solution

1
Analyze frame encapsulation logs for 802.1Q tags.
Multiple nested 802.1Q VLAN headers sent from an access port demonstrate an exploitation of switch native VLAN tag stripping, which is characteristic of double tagging VLAN hopping.
Switches strip the outer native VLAN tag and forward the frame with the inner tag to another targeted VLAN without validating access rules.
2
Examine DHCP protocol interaction logs.
Unauthorized answers offering network configuration parameters (Option 3 for Default Gateway) point to a Rogue DHCP Server.
Attackers place rogue DHCP servers on a segment to redirect default gateway traffic to an attacker-controlled address for man-in-the-middle operations.
3
Evaluate wireless short-range data exchange protocol logs.
Unsolicited access using OBEX Push profile to download internal device memory (contacts) characterizes Bluesnarfing.
Bluesnarfing targets Bluetooth vulnerabilities to steal confidential information, unlike Bluejacking which only transmits unwanted messages.
4
Inspect physical security proximity credential timing logs.
Propagation delays during ISO 14443 contactless smart card challenge-responses signal an intermediary proxying the signal, defining a Relay Attack.
Relay attacks transmit contactless RFID/NFC RF signals over secondary channels, introducing measurable latency into proximity validation protocols.

Key Concept

Network and Wireless Attack Indicators
Estimated Time:2m 0s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic