Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst reviews network traffic captures following reports of credential leakage on an internal subnet. The analyst observes frequent UDP port 5355 multicast traffic where an unauthenticated endpoint rapidly responds to failed host name resolution requests from legitimate clients, prompting those clients to attempt NTLMv2 authentication against the endpoint. Which of the following attack types is most directly indicated by this activity?

  1. Link-Local Multicast Name Resolution (LLMNR) poisoningAnswer
  2. B
    ARP cache poisoning
  3. C
    DNS cache poisoning
  4. D
    Rogue DHCP server deployment

Answer

The network activity indicates Link-Local Multicast Name Resolution (LLMNR) poisoning, where an attacker responds to fallback local hostname resolution requests over UDP port 5355 to capture user authentication hashes.
The correct answer identifies Link-Local Multicast Name Resolution (LLMNR) poisoning. LLMNR uses UDP port 5355 to resolve hostnames on the local subnet when primary DNS resolution fails. Attackers run tools to listen for these multicast requests and spoof replies, convincing victim machines to attempt NTLMv2 authentication against the attacker's machine, thereby capturing authentication hashes.

Step-by-Step Solution

1
Analyze the network protocol and port observed in the traffic captures
The traffic relies on UDP port 5355, which is the standard port for Link-Local Multicast Name Resolution (LLMNR).
Identifying the transport protocol and port establishes the target service mechanism being exploited.
2
Examine the client-server interaction behavior and payload handling
The endpoint responds to failed hostname queries, causing clients to transmit NTLMv2 authentication credentials to the attacker.
LLMNR fallback occurs when DNS fails, allowing an attacker to spoof the destination identity and harvest authentication hashes.
3
Differentiate LLMNR poisoning from other layer 2/3 redirection attacks
Unlike ARP or DNS poisoning, LLMNR poisoning explicitly exploits local fallback multicast queries when primary name resolution fails.
Distinguishing the specific indicator (UDP 5355 + hostname fallback + NTLMv2 capture) confirms LLMNR poisoning as the correct diagnosis.

Key Concept

LLMNR/NBT-NS Poisoning Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic