Question

Difficulty: EasyNetwork and Wireless Attack Indicators

Match each observed wireless or network anomaly on the left with its corresponding attack classification on the right.

  • Unsolicited contact cards or text messages appearing on a mobile device via short-range wireless connections without requesting data theft.Bluejacking
  • Frequent transmission of spoofed 802.11 control frames causing immediate dropped wireless connections for connected endpoints.Disassociation Attack
  • A massive spike in noise floor levels across 2.4 GHz channels leading to severe degradation of signal-to-noise ratio and complete connection loss.Radio Frequency Jamming
  • Switch security alerts indicating that an identical media access control address is registered on two different physical switch ports.MAC Spoofing

Answer

Unsolicited short-range messages correspond to Bluejacking; spoofed 802.11 control frames disconnecting clients correspond to a Disassociation Attack; high noise floor across frequency channels corresponds to Radio Frequency Jamming; and identical physical addresses appearing on multiple switch ports corresponds to MAC Spoofing.
Each indicator uniquely points to a distinct network or wireless attack vector based on standard security monitoring signatures: short-range spam maps to Bluejacking, 802.11 frame forgery maps to Disassociation, RF noise flooding maps to Jamming, and duplicate physical layer addressing maps to MAC Spoofing.

Step-by-Step Solution

1
Analyze the indicator involving unsolicited Bluetooth messages.
Identify that pushing unsolicited messages over Bluetooth without unauthorized data retrieval defines Bluejacking.
Bluejacking focuses on message sending, whereas Bluesnarfing involves unauthorized data extraction.
2
Examine the indicator regarding spoofed 802.11 management frames.
Match 802.11 frame manipulation targeted at client disconnection to a Disassociation Attack.
Attackers forge management frames to force clients off the wireless network.
3
Evaluate the RF noise floor anomaly.
Correlate channel-wide noise spikes and degraded signal-to-noise ratio with Radio Frequency Jamming.
Jamming impacts physical layer radio frequencies by overpowering legitimate wireless signals.
4
Inspect the duplicate physical address log alert.
Associate identical hardware addresses on distinct switch ports with MAC Spoofing.
Impersonating another endpoint's network interface card address causes switch table conflicts.

Key Concept

Network and Wireless Attack Indicators
Rate this question