An aerospace engineering enterprise recently completed a third-party technical audit of its internal infrastructure. Match each security weakness scenario on the left with the corresponding cryptographic or control vulnerability on the right.
- An internal portal encrypts session tokens using AES-CBC without a message authentication code, permitting unauthorized modification of encrypted payload flags.Bit-flipping vulnerability caused by unauthenticated cipher mode usage
- An IoT gateway uses a single pre-installed asymmetric key pair compiled directly into firmware across 10,000 deployed field sensors.Improper key management resulting in private key reuse across endpoints
- A firmware update distribution server verifies binary signatures using SHA-1 digest comparisons.Hash collision vulnerability inherent to deprecated digest algorithms
- A legacy VPN gateway supports 512-bit Diffie-Hellman groups during TLS key agreement negotiations.Weak key exchange implementation vulnerable to decryption via low key length parameters
Answer
Each scenario correctly pairs with its underlying vulnerability: the unauthenticated AES-CBC portal matches the bit-flipping vulnerability; the firmware with identical keys matches key reuse from improper key management; SHA-1 signature verification matches the hash collision vulnerability; and 512-bit Diffie-Hellman negotiation matches weak key exchange implementation.
The correct pairings align each operational scenario with its underlying technical failure: CBC mode without MAC enables ciphertext bit manipulation; shared embedded keys breach isolation principles through key reuse; SHA-1 signature checks are susceptible to collision attacks; and 512-bit DH groups fail to withstand parameter cracking.
Step-by-Step Solution
Key Concept
Identification and remediation of cryptographic protocol weaknesses and security control flaws
Estimated Time:2m 0s