Unit 5: Cyber Security and Cyber Crime Fundamentals

Section A — 1 Mark Questions

1. Define Hacking. [1 Mark]

Answer: Hacking refers to the unauthorized access to computer systems or networks to manipulate, steal, or damage data.

2. What is Phishing? [1 Mark]

Answer: Phishing is a fraudulent attempt to obtain sensitive information like usernames or passwords by disguising as a trustworthy entity in electronic communication.

3. Define Data Masking. [1 Mark]

Answer: Data masking is the process of hiding original data with modified content to protect sensitive information.

4. What is Cryptanalysis? [1 Mark]

Answer: Cryptanalysis is the art and science of breaking encrypted codes or ciphers to retrieve the original information.

5. Define Cyber warfare. [1 Mark]

Answer: Cyber warfare involves the use of digital attacks by one nation-state against another to cause damage to systems or information.

6. What is Spoofing? [1 Mark]

Answer: Spoofing is a technique where an attacker masquerades as a trusted person or program to deceive a system or user.

7. Define Cracking. [1 Mark]

Answer: Cracking is the act of breaking into a system with malicious intent, often to destroy data or commit fraud.

8. What is Scanning in cyber security? [1 Mark]

Answer: Scanning is a technique used by attackers to identify active IP addresses, open ports, and services on a network.

9. Define Session hijacking. [1 Mark]

Answer: Session hijacking is an attack where an intruder takes control of a valid user session to gain unauthorized access to information or services.

10. What is Malicious software? [1 Mark]

Answer: Malicious software, or malware, is any program or file that is intentionally harmful to a computer, network, or server.

11. State one characteristic of a strong password. [1 Mark]

Answer: A strong password typically uses a combination of uppercase letters, lowercase letters, numbers, and special characters.

12. What makes a password a 'weak password'? [1 Mark]

Answer: A weak password is typically short, contains common words, or is easily predictable like '123456'.

13. Why is the IT Act 2008 important? [1 Mark]

Answer: It provides a legal framework to govern electronic commerce and address cyber crimes in the country.

14. What is the primary purpose of Information Gathering techniques? [1 Mark]

Answer: To collect intelligence about a target's infrastructure, network, and vulnerabilities before launching an attack.

15. What does an attacker look for during the Scanning phase? [1 Mark]

Answer: Attackers look for live hosts, open ports, and operating system details.

16. Is unauthorized access to a network considered hacking? [1 Mark]

Answer: Yes, it is a primary form of hacking.

17. Name one common tool or technique used for information gathering. [1 Mark]

Answer: Footprinting or open-source intelligence (OSINT) gathering.

18. What is the main objective of the IT Act? [1 Mark]

Answer: To provide legal recognition for electronic transactions and digital signatures.

19. Can session hijacking be prevented? [1 Mark]

Answer: Yes, by using secure communication protocols like HTTPS and ensuring unique session tokens.

20. What is the risk associated with weak passwords? [1 Mark]

Answer: Increased susceptibility to brute-force or dictionary attacks.

Section B — 2/3 Mark Questions

1. Differentiate between Hacking and Cracking. [2 Marks]

Answer: Hacking is often a broad term involving technical mastery over systems, sometimes performed by ethical hackers for security testing. Cracking is specifically defined as unauthorized and malicious entry into systems to cause harm or steal information.

2. Explain the concept of Data Masking with an example. [2 Marks]

Answer: Data masking replaces real data with dummy or surrogate data. For example, replacing a customer's credit card number '1234-5678-9012-3456' with 'XXXX-XXXX-XXXX-3456' ensures privacy during processing.

3. Why is information gathering critical for an attacker? [3 Marks]

Answer: Information gathering is the foundation of any attack. It allows the attacker to: 1. Identify specific vulnerabilities in the target system. 2. Map out the network topography. 3. Select the most effective tools for the subsequent exploitation phase.

4. What are the primary objectives of the IT Act 2008? [2 Marks]

Answer: The IT Act 2008 aims to provide legal validity to electronic records and digital signatures, and to establish a regulatory authority to facilitate e-governance and curb cyber crime.

5. List three types of malicious software. [3 Marks]

Answer: 1. Viruses: Programs that replicate by attaching to other files. 2. Trojans: Software that appears legitimate but performs malicious actions. 3. Ransomware: Software that encrypts user data and demands payment for access.

6. How does Phishing differ from Spoofing? [2 Marks]

Answer: Phishing is a social engineering attack aimed at stealing credentials, whereas Spoofing is the technical act of faking an identity (such as an IP or email address) to deceive a system or user.

7. Describe the risks associated with session hijacking. [3 Marks]

Answer: 1. The attacker can access private user data. 2. The attacker can impersonate the user to perform unauthorized transactions. 3. The attacker can gain administrative rights if the hijacked session belongs to an admin.

8. What are the components of a 'Strong Password'? [2 Marks]

Answer: A strong password should have a minimum length (usually 12+ characters) and utilize a mix of character types including uppercase, lowercase, numbers, and symbols, while avoiding easily guessable personal info.

9. Briefly explain the concept of scanning in the context of cyber security. [2 Marks]

Answer: Scanning is a reconnaissance activity used by attackers to find network entry points. It involves identifying which services are running, which ports are open, and what version of software is being used.

10. Mention two sections of the IT Act related to cyber crime. [3 Marks]

Answer: 1. Section 66: Deals with computer-related offenses such as hacking and identity theft. 2. Section 66A: Previously dealt with sending offensive messages via communication services. 3. Section 67: Covers the publication of obscene material in electronic form.

Section C — 5 Mark Questions

1. Explain the different phases of Information Gathering techniques used by an attacker. [5 Marks]

Answer:

Introduction

Information gathering is the initial phase where an attacker collects as much data as possible about the target system or organization.

Key Phases

• Passive Reconnaissance: Involves gathering information from publicly available sources without directly interacting with the target's systems. This includes searching social media, public records, and WHOIS databases.
• Active Reconnaissance: Involves direct interaction with the target system to gain information. This can involve techniques like port scanning or banner grabbing to determine system versions.
• Network Mapping: The attacker attempts to draw a map of the network infrastructure, including IP ranges, firewalls, and servers to identify potential entry points.
• Vulnerability Identification: Once the infrastructure is mapped, the attacker looks for known security weaknesses, such as outdated software or unpatched services, that can be exploited in the next phase.

Conclusion

Effective information gathering significantly increases the success rate of a cyber attack by allowing the attacker to tailor their methods to the specific weaknesses of the target.

2. Discuss the importance of the IT Act 2008 and how it addresses modern cyber challenges. [5 Marks]

Answer:

Introduction

The Information Technology Act, 2008 (an amendment to the 2000 act) serves as the primary legislation in India for regulating electronic communication and digital business.

Importance

• Legal Recognition: It provides legal validity for electronic contracts and digital signatures, which is essential for e-commerce and e-governance.
• Cyber Crime Regulation: It defines various cyber crimes such as hacking, identity theft, and data theft, establishing punishments for these activities.
• Security Standards: It mandates the implementation of reasonable security practices to protect sensitive personal data and information.
• Regulatory Bodies: The act empowers authorities like the Certifying Authorities and the Cyber Appellate Tribunal to handle digital disputes and maintain technical standards.

Addressing Challenges

The Act has evolved to include provisions for handling modern threats like phishing and unauthorized access, ensuring that law enforcement has the mandate to investigate digital crimes effectively.

3. Define Malicious Software and elaborate on three types with their impacts. [5 Marks]

Answer:

Definition

Malicious software, or malware, refers to any program or code designed to infiltrate, damage, or disable computer systems without the user's consent.

Types and Impacts

• Viruses: These are programs that attach themselves to legitimate files. When the file is executed, the virus spreads. Impact: Corrupts files and hampers system performance.
• Ransomware: A type of malware that encrypts a victim's data. The attacker then demands a ransom in exchange for the decryption key. Impact: Loss of availability of critical business or personal data.
• Spyware: Software installed covertly on a device to monitor user activity. It collects data like keystrokes, browsing habits, and passwords. Impact: Serious privacy breach and potential identity theft.

Conclusion

Malware remains a significant threat, requiring advanced security tools and user awareness to prevent unauthorized installation and data exfiltration.

4. Describe the mechanics of Session Hijacking and explain how it can be mitigated. [5 Marks]

Answer:

Introduction

Session hijacking occurs when an attacker gains unauthorized access to a legitimate user's active session, usually by stealing the unique session ID assigned by a server after login.

Mechanics

• Token Interception: Attackers can intercept the session cookie using methods like packet sniffing on unsecured networks.
• Cross-Site Scripting (XSS): An attacker may inject malicious scripts into a web page to steal the user's session tokens stored in the browser.
• Session Prediction: If a web server uses weak algorithms to generate session IDs, an attacker might predict valid tokens to impersonate users.

Mitigation Strategies

• Use HTTPS to encrypt all traffic, preventing packet sniffing of tokens.
• Implement short session timeouts and regenerate session IDs after every successful login.
• Utilize secure HTTP-only cookies that cannot be accessed by client-side scripts.

Conclusion

By securing the communication channel and hardening the session management process, organizations can effectively prevent attackers from impersonating legitimate users.

5. Compare strong and weak passwords, and explain the best practices for password management. [5 Marks]

Answer:

Comparison

Best Practices

• Complexity: Always use a mix of character types and ensure sufficient length (at least 12-14 characters).
• Uniqueness: Never use the same password across multiple platforms, as one breach leads to compromise everywhere.
• Management: Use a reputable password manager to store encrypted versions of complex passwords so you do not have to memorize them.
• Multi-Factor Authentication (MFA): Even if a password is cracked, MFA adds a secondary layer of security by requiring a code or biometric check.

Conclusion

Password security is the first line of defense; adopting strong practices significantly reduces the likelihood of unauthorized account access.