NETWORK SECURITY AND INTRUSION DETECTION SYSTEMS
1 1. MALWARE DETECTION AND PREVENTION
Problem 1. Consider a network intrusion detection system that uses a signature-based ap-
proach to detect malware. The system has a false positive rate of 0.05 (5%) and a false negative
rate of 0.10 (10%). If the system detects malware in 80 out of 100 infected devices, what is the
overall accuracy of the system?
Solution 1. Let’s define the following terms:
•True Positive (TP) = 80 (devices with malware detected correctly)
•False Positive (FP) = 5 (devices without malware detected incorrectly)
•True Negative (TN) = ? (correctly identified devices without malware)
•False Negative (FN) = ? (malware-infected devices not detected)
Given the false positive rate is 0.05 and the false negative rate is 0.10, we can calculate the
True Negative (TN) and False Negative (FN) values as follows:
False Positives (FP) = 0.05 ×Total Non-infected Devices = 0.05 ×(100 −80) = 5
True Negatives (TN) =Total Non-infected Devices −False Positives (FP) = 20
False Negatives (FN) = 0.10 ×Total Infected Devices = 0.10 ×80 = 8
Now, we can calculate the accuracy of the system using the following formula:
Accuracy =TP +TN
Total Devices
=80 + 20
100
=100
100
= 1 or 100%
Therefore, the overall accuracy of the system is 100%.
2 2. INSIDER THREATS AND DATA BREACHES
Problem 2. An employee working for a financial company has access to sensitive customer
data. The company implements a data loss prevention system to monitor and detect any unautho-
rized data transfers. The system logs show that the employee transferred a total of 500 MB of data
in the last 30 days. The company’s policy allows employees to transfer up to 20 MB of data per
day for work-related purposes.
If the company wants to investigate whether the employee is involved in a data breach, calculate
the average daily data transfer by the employee over the last 30 days. Determine if the employee
exceeded the allowed data transfer limit on any specific day.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
Solution 2. a) To find the average daily data transfer by the employee over the last 30 days,
we divide the total data transferred by 30 days:
Average daily data transfer =500 MB
30 days =50
3≈16.67 MB/day
b) To check if the employee exceeded the allowed data transfer limit of 20 MB on any specific
day, we divide the total data transfer by the number of days and compare it to the daily limit:
Daily data transfer limit =500 MB
30 days =50
3≈16.67 MB/day
Since the average daily data transfer is below the daily limit of 20 MB, the employee did not
exceed the allowed limit on any specific day.
Therefore, the average daily data transfer by the employee over the last 30 days is approximately
16.67 MB/day, and the employee did not exceed the allowed data transfer limit on any specific day.
3 3. ENCRYPTION VULNERABILITIES
Problem 3. Consider a symmetric encryption scheme where a 128-bit key is used to encrypt
messages. An attacker captures a ciphertext and the corresponding plaintext, and they try to
recover the key using a known-plaintext attack.
The attacker knows that the encryption algorithm used is vulnerable to a simple brute-force
attack and can test 230 keys per second. How long would it take for the attacker to recover the key?
Solution 3.
Given that there are 2128 possible keys in a 128-bit key space, the time to perform a brute-force
attack can be calculated by dividing the total number of keys by the number of keys tested per
second.
Time to test one key =1
230 seconds
Time to test all keys = 2128 ×1
230 seconds
= 298 seconds
Converting this to years:
Time in years ≈298 seconds
60 ×60 ×24 ×365
≈298
31536000 years
≈3.68 ×1021 years
Therefore, it would take approximately 3.68 ×1021 years for the attacker to recover the key
using a brute-force attack. This demonstrates the strength of using a large key size in encryption
algorithms to resist brute-force attacks.
4 4. PHISHING AND SOCIAL ENGINEERING ATTACKS
Problem 4. A company’s employees have been targeted by a phishing email campaign. The
emails contain a link that directs employees to a fake login page that resembles the company’s
official login page. The phishing website collects employee usernames and passwords when they
attempt to log in. The company’s network security team is analyzing the captured data to determine
the impact of the phishing attack.
The team identifies the following information from the phishing attack: - Total number of em-
ployee accounts: 500 - Number of employees who fell for the phishing email and provided their
login credentials: 50 - Number of unique passwords collected from the phishing website: 40 -
Number of employees who used the same password for multiple accounts: 10
a) Calculate the percentage of employees who fell for the phishing email. b) Determine the
percentage of unique passwords collected from the phishing website. c) Calculate the percentage
of compromised accounts due to employees reusing passwords.
Solution 4. a) To calculate the percentage of employees who fell for the phishing email, we di-
vide the number of employees who provided their login credentials by the total number of employee
accounts and then multiply by 100.
a) Percentage of employees who fell for the phishing email:
50
500 ×100 = 10%
Therefore, 10
b) To determine the percentage of unique passwords collected from the phishing website, we
divide the number of unique passwords by the total number of employees who fell for the phishing
email and then multiply by 100.
b) Percentage of unique passwords collected:
40
50 ×100 = 80%
Thus, 80
c) To calculate the percentage of compromised accounts due to employees reusing passwords,
we divide the number of employees who reused passwords by the total number of employees who
fell for the phishing email and then multiply by 100.
c) Percentage of compromised accounts due to password reuse:
10
50 ×100 = 20%
Therefore, 20
5 5. DNS SPOOFING AND HIJACKING
Problem 5. Consider a scenario where an attacker performs DNS spoofing to redirect users
from a legitimate banking website to a fake website controlled by the attacker. The attacker changes
the DNS records so that when users enter the legitimate domain name "www.bank.com," they are
directed to the IP address of the attacker’s fake website.
a) If the legitimate IP address of "www.bank.com" is 192.168.1.100 and the attacker’s fake
website IP address is 203.101.50.25, what DNS record must the attacker change to carry out the
attack successfully?
b) If a user attempts to access "www.bank.com" and is redirected to the attacker’s fake website,
what potential risks could the user face?
c) Suggest a measure that the bank could implement to mitigate the risk of DNS spoofing
attacks.
Solution 5.
a) To carry out the DNS spoofing attack successfully, the attacker must change the DNS A
record mapping the domain "www.bank.com" to the legitimate IP address 192.168.1.100 to the
attacker’s fake website IP address 203.101.50.25.
b) When a user is redirected to the attacker’s fake website instead of the legitimate banking
website, they are at risk of entering sensitive information such as login credentials, credit card
details, or personal information on the fake website. This information can be captured by the
attacker and used for malicious purposes like identity theft, financial fraud, or unauthorized access
to the user’s accounts.
c) To mitigate the risk of DNS spoofing attacks, the bank could implement DNSSEC (DNS
Security Extensions). DNSSEC adds a layer of security by digitally signing DNS records to ensure
their authenticity and integrity. By validating these digital signatures, clients can verify that the
received DNS responses are legitimate and have not been tampered with by attackers. DNSSEC
helps prevent DNS spoofing and hijacking attacks by providing secure DNS resolution.
I can create a series of numerical problem questions on Network Security and Intrusion Detec-
tion Systems with detailed solutions. Let’s start with the first problem:
6 6. DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
Problem 6. Consider a Distributed Denial of Service (DDoS) attack that is flooding a web
server with HTTP requests. The attack is generating an average of 5000 requests per second.
The defending system has a capacity to handle up to 8000 requests per second before it crashes.
Determine the Attack Traffic Rate and the Attack Traffic Intensity in this scenario.
Solution 6. Let’s calculate the Attack Traffic Rate and the Attack Traffic Intensity:
a) The Attack Traffic Rate is the rate at which the attack traffic is flooding the server. It is given
as 5000 requests per second.
b) The Attack Traffic Intensity is the ratio of the attack traffic rate to the server’s capacity. It is
calculated as follows:
Attack Traffic Intensity = Attack Traffic Rate / Server Capacity
Attack Traffic Intensity = 5000 / 8000 = 0.625
Therefore, the Attack Traffic Rate is 5000 requests per second and the Attack Traffic Intensity
is 0.625 in this scenario.
This problem highlights the importance of monitoring and managing the traffic flow to prevent
server overloads during a DDoS attack.
I am glad you are interested in numerical questions. Let’s work together on a problem focused
on intrusion detection systems.
7 7. VULNERABILITIES IN IOT DEVICES
Problem 7. An Intrusion Detection System (IDS) is monitoring a network for potential attacks. The
system has a False Positive Rate (FPR) of 0.05 and a False Negative Rate (FNR) of 0.10.
a) If there are 200 legitimate connections and 50 attack attempts, how many of these will the
IDS correctly identify as attacks?
b) Calculate the Precision of the IDS.
Solution 7.
a) To calculate the number of attacks correctly identified by the IDS, we can use the False
Negative Rate (FNR). The FNR is the proportion of attacks incorrectly identified as legitimate con-
nections.
Number of attacks correctly identified = (1 - FNR) * Total number of attacks
Number of attacks correctly identified = (1 - 0.10) * 50 = 0.90 * 50 = 45 attacks
Therefore, the IDS will correctly identify 45 out of the 50 attack attempts.
b) The Precision of the IDS measures the proportion of correctly identified attacks among all
instances classified as attacks.
Precision = True Positives / (True Positives + False Positives)
We already know the number of True Positives (45) from part (a). To find the number of False
Positives, we can use the False Positive Rate (FPR).
False Positives = FPR * Total number of legitimate connections
False Positives = 0.05 * 200 = 10
Precision = 45 / (45 + 10) = 45 / 55 0.8182
Therefore, the Precision of the IDS is approximately 0.8182.
I. Problem: An organization’s network is hit by a ransomware attack. The attacker demands
a ransom of $10,000 in Bitcoin to restore access to the encrypted files. The organization decides
not to pay the ransom and instead focuses on improving their cybersecurity measures. As part of
their efforts, they invest $5,000 in a new intrusion detection system.
a) If the organization’s cybersecurity measures are successful in preventing a similar ran-
somware attack in the future, what is their net monetary gain/loss from the ransomware attack
and investment in the intrusion detection system?
b) Suppose the intrusion detection system is successful in detecting and preventing a different
type of cyber attack that would have cost the organization $7,500 in damages. What is the net
monetary gain/loss from the ransomware attack and investment in the intrusion detection system
in this scenario?
Solution:
a) The net monetary gain/loss from the ransomware attack and investment in the intrusion
detection system can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) - (Cost of intrusion detec-
tion system)
Money saved from preventing ransomware attack = $10,000 (ransom not paid) Cost of intrusion
detection system = $5,000
Net Gain/Loss = $10,000 - $5,000 = $5,000
Therefore, the organization would have a net monetary gain of $5,000 if their cybersecurity
measures successfully prevent a similar ransomware attack in the future.
b) In this scenario, the net monetary gain/loss can be calculated as follows:
Net Gain/Loss = (Money saved from preventing ransomware attack) + (Money saved from pre-
venting other cyber attack) - (Cost of intrusion detection system)
Money saved from preventing other cyber attack = $7,500 (potential damages avoided) Net
Gain/Loss = $10,000 + $7,500 - $5,000 = $12,500
Therefore, in this scenario, the organization would have a net monetary gain of $12,500 con-
sidering the prevention of both ransomware and another cyber attack.
8 9. ENDPOINT SECURITY
Problem 9. Consider a network with 50 endpoint devices. The IT team wants to implement
endpoint security by deploying antivirus software on all devices. The antivirus software has a
detection rate of 95% for known malware.
a) If a device is infected with malware, what is the probability that the antivirus software will
detect it?
b) If each device is independently infected with malware, what is the probability that at least
one device will go undetected by the antivirus software?
Solution 9.
a) The probability that the antivirus software will detect malware on a device is given by the de-
tection rate, which is 95%. Therefore, the probability that the antivirus software will detect malware
on a device is 0.95 or 95%.
b) The probability that at least one device will go undetected by the antivirus software can be
calculated using the complement rule. The probability that all devices are detected by the antivirus
software is the complement of at least one device going undetected.
Let Abe the event that a device is detected by the antivirus software, and A′be the event that
a device is not detected. The probability of at least one device going undetected is:
P(At least one device not detected) = 1 −P(All devices detected)
= 1 −(P(A))50
= 1 −0.9550
≈1−0.075
≈0.925
Therefore, the probability that at least one device will go undetected by the antivirus software
is approximately 92.5%.
8.1 10. MAN-IN-THE-MIDDLE ATTACKS
Problem 10. Consider a network where Alice wants to securely communicate with Bob. An at-
tacker, Eve, performs a man-in-the-middle attack by intercepting and altering the messages be-
tween Alice and Bob.
Suppose Alice uses symmetric encryption with a secret key Kto encrypt her messages. Eve
intercepts a message encrypted by Alice, decrypts it using the key K, alters the content, encrypts
it again with the same key, and sends it to Bob. Bob decrypts the message using his key Kand
reads the modified content.
Given that the original message sent by Alice was "HELLO", and Eve changes it to "JELLO",
determine the impact of Eve’s alteration in terms of confidentiality and integrity.
Solution 10. The impact of Eve’s alteration in the man-in-the-middle attack on confidentiality
and integrity of the communication can be analyzed as follows:
a) Confidentiality: For confidentiality, we look at whether the message content remains secret
from unauthorized parties. In this case, Eve was able to decrypt and read the original message
sent by Alice, and then alter it before sending it to Bob. Since Eve was able to decrypt the message,
confidentiality is compromised.
b) Integrity: Integrity refers to ensuring that the message has not been altered or tampered with
during transmission. In this scenario, Eve changed the original message "HELLO" to "JELLO" be-
fore passing it on to Bob. This alteration compromises the integrity of the communication because
Bob receives a modified message different from what Alice sent.
I will provide a numerical problem on Network Security and Intrusion Detection Systems under
the subtopic 11. NETWORK FORENSICS AND INCIDENT RESPONSE.
9 11. NETWORK FORENSICS AND INCIDENT RESPONSE
Problem 11. Consider a network with four hosts A, B, C, and D. An intrusion detection system
(IDS) deployed on this network is monitoring the traffic. The IDS generates the following alerts over
a period of time:
- 30 alerts were generated regarding traffic between host A and host B - 15 alerts were gen-
erated regarding traffic between host A and host C - 20 alerts were generated regarding traffic
between host A and host D - 10 alerts were generated regarding traffic between host B and host C
- 5 alerts were generated regarding traffic between host B and host D - 25 alerts were generated
regarding traffic between host C and host D
Assuming that the number of alerts generated is directly proportional to the level of suspicious
activity between two hosts, calculate the percentage of alerts generated between host C and host
D out of the total alerts generated.
Solution 11. a) To calculate the total number of alerts generated: Total = 30 (A-B) + 15 (A-C)
+ 20 (A-D) + 10 (B-C) + 5 (B-D) + 25 (C-D) = 30 + 15 + 20 + 10 + 5 + 25 = 105
b) Calculate the percentage of alerts between host C and host D out of the total: Percentage =
(25 / 105) * 100 = 23.8
Therefore, 23.8
10 12. IDENTITY THEFT AND FRAUD
Problem 12. A company’s network security system uses anomaly detection to identify potential
threats. The system flags any data packet with a score greater than 0.7 as suspicious. The anomaly
detection model generates scores that follow a normal distribution with a mean of 0.6 and a standard
deviation of 0.1.
a) What is the probability that a randomly selected data packet will be flagged as suspicious?
b) If the network receives 2000 data packets, how many of them are expected to be flagged as
suspicious?
c) What is the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious?
Solution 12. a) We need to find P(X > 0.7), where Xis the score of a data packet. This can
be calculated using the standard normal distribution formula:
P(X > 0.7) = 1 −P(X≤0.7) = 1 −Φ0.7−0.6
0.1= 1 −Φ(1) = 1 −0.8413 = 0.1587
Therefore, the probability that a randomly selected data packet will be flagged as suspicious is
0.1587 or 15.87
b) The expected number of flagged data packets out of 2000 can be found by multiplying the
probability of being flagged (0.1587) by the total number of data packets:
Expected flagged packets = 0.1587 ×2000 = 317.4
Therefore, it is expected that approximately 317 data packets will be flagged as suspicious out
of 2000.
c) To find the probability that exactly 1500 out of 2000 data packets will be flagged as suspicious,
we use the binomial distribution formula:
P(X= 1500) = 2000
1500×(0.1587)1500 ×(1 −0.1587)500
Calculating this value:
P(X= 1500) ≈2000
1500×(0.1587)1500 ×(1 −0.1587)500 ≈0.0996
Therefore, the probability that exactly 1500 out of the 2000 data packets will be flagged as
suspicious is approximately 9.96
11 13. UNAUTHORIZED ACCESS AND PRIVILEGE ESCALATION
Problem 13. An organization has implemented a password policy where passwords must be
at least 8 characters long, contain at least one uppercase letter, at least one lowercase letter, and
at least one number. Suppose an attacker is attempting to brute force this password policy. Given
that the password space consists of 26 uppercase letters, 26 lowercase letters, and 10 numbers,
calculate the total number of possible passwords that satisfy the organization’s policy.
Solution 13. To calculate the total number of possible passwords that satisfy the organization’s
policy, we need to find the number of ways we can form an 8-character password using at least
one uppercase letter, at least one lowercase letter, and at least one number.
Total number of possibilities for each character position: 1) Uppercase letter: 26 possibilities 2)
Lowercase letter: 26 possibilities 3) Number: 10 possibilities
Total number of possible passwords = 26×26×10×(number of ways to arrange the rest of the characters)
The rest of the characters can be any combination of uppercase letters, lowercase letters, and
numbers. Since the password must be at least 8 characters long, we need to consider 5 more
characters in addition to the 3 characters we already have.
Therefore, the total number of ways to arrange the remaining 5 characters is (26 + 26 + 10)5
since each of the 5 characters can be one of the 26 uppercase letters, 26 lowercase letters, or 10
numbers.
Putting it all together, the total number of possible passwords that satisfy the organization’s
policy is:
26 ×26 ×10 ×(26 + 26 + 10)5
= 26 ×26 ×10 ×625
= 26 ×26 ×10 ×916132832
= 608,606,509,440
Therefore, there are 608,606,509,440 possible passwords that satisfy the organization’s policy.
12 14. CROSS-SITE SCRIPTING (XSS) ATTACKS
Problem 14. Consider a website vulnerable to a reflected XSS attack. The attacker sends a
malicious link to a user, which, when clicked, executes a script that steals the user’s session cookie.
The website uses an HTTP-only secure session cookie with a length of 64 characters and uses the
AES encryption algorithm with a 256-bit key to protect sensitive information. The attacker’s script
successfully steals the session cookie.
Given that the attacker needs to decrypt the stolen session cookie offline, determine the number
of possible keys the attacker needs to try to decrypt the session cookie using a brute force attack.
Solution 14.
To determine the number of possible keys the attacker needs to try to decrypt the session
cookie using a brute force attack, we first calculate the total possible number of keys for a 256-bit
key encryption algorithm.
Since each bit can have 2 possibilities (0 or 1), for a 256-bit key, the total number of possible
keys is 2256.
Therefore, the attacker would need to try 2256 possible keys to decrypt the stolen session cookie
using a brute force attack.
13 15. WEB APPLICATION SECURITY
Problem 15. Consider a web application that is vulnerable to SQL injection attacks. An at-
tacker successfully executes a SQL injection attack and retrieves sensitive user information from
the database. The attacker then uses this information to gain unauthorized access to the web
application’s admin panel.
The attacker now plans to elevate their privileges within the system to obtain full control. To
achieve this, the attacker decides to exploit a known vulnerability in the admin panel’s file upload
functionality.
a) The admin panel allows users to upload files with the following restrictions: only files with
the extensions ".jpg", ".png", and ".gif" are permitted. However, the attacker discovers that the file
extension check can be bypassed. Describe how the attacker can upload a malicious PHP script
(e.g., shell.php) to the server.
b) Once the malicious PHP script is uploaded, the attacker aims to execute system commands
on the server. Explain how the attacker can craft a command payload within the PHP script to
achieve command execution.
c) What preventive measures can the web application implement to mitigate the risks associated
with file upload vulnerabilities?
Solution 15.
a) The attacker can bypass the file extension check by simply renaming their malicious PHP
script (e.g., shell.php) to have a permitted file extension like ".jpg". Even if the content of the file
is a PHP script, the server will still execute it as PHP code, allowing the attacker to run malicious
commands.
b) Within the uploaded PHP script, the attacker can include a command execution payload
using functions like ‘exec()‘ or ‘system()‘. For example, the attacker can include the following code
snippet in shell.php to execute system commands:
<?php
$command = $_GET['cmd'];
echo "<pre>";
system($command);
echo "</pre>";
?>
By accessing shell.php with a command parameter in the URL (e.g., shell.php?cmd=ls), the
attacker can execute arbitrary system commands on the server.
c) To mitigate risks associated with file upload vulnerabilities, the web application can implement
the following preventive measures:
1. Validate file types on the server-side: In addition to client-side checks, the server should
verify the file type based on its content and not solely rely on the file extension.
2. Store uploaded files in a secure directory: Limit the permissions on the directory where
uploaded files are saved to prevent execution of any uploaded scripts.
3. Disable PHP execution for upload directories: Configure the web server to disable PHP
execution in directories where user-uploaded files are stored to prevent malicious scripts from being
executed.
4. Implement file size and content checks: Enforce restrictions on file sizes and examine file
content to detect potentially malicious files.
By implementing these measures, the web application can enhance its security and reduce the
likelihood of successful exploitation through file upload vulnerabilities.
14 16. BOTNET DETECTION AND MITIGATION
Problem 16. A network administrator is analyzing traffic logs for a company’s network and
notices suspicious activity from an IP address. The traffic from this IP address shows unusual
patterns that indicate potential botnet activity. The administrator decides to investigate further by
analyzing the flow data of the packets. The flow data for this particular IP address in a given time
period shows the following statistics:
Total number of packets sent: 5000
Total number of packets received: 3000
Total number of unique destination IP addresses contacted: 20
Total number of unique ports contacted: 15
Total number of packets sent to a single destination IP address: 1500
Total number of packets received from a single source IP address: 1000
Total number of packets sent to a single port: 2000
Total number of packets received from a single port: 1500
Total number of bidirectional packet exchanges (packets sent from and received by the IP address):
1000
a) Calculate the ratio of packets sent to packets received by the IP address.
b) Determine the average number of packets sent to each destination IP address contacted.
c) Find the percentage of packets that were bidirectional in nature.
Solution 16.
a) The ratio of packets sent to packets received can be calculated as:
Ratio =Packets Sent
Packets Received =5000
3000 = 1.67
b) The average number of packets sent to each destination IP address contacted is:
Average packets sent per destination IP =Packets Sent
Unique Destination IP addresses =5000
20 = 250
c) The percentage of packets that were bidirectional can be calculated as:
Percentage of bidirectional packets =Bidirectional packets
Total packets ×100 = 1000
5000 ×100 = 20%
Therefore, the answers are: a) Ratio of packets sent to packets received: 1.67
b) Average number of packets sent to each destination IP address contacted: 250
c) Percentage of packets that were bidirectional: 20%
15 17. NETWORK ANOMALY DETECTION
Problem 17. Consider a network with 1000 devices that communicate with each other. The
average number of connections per device in this network is 15. If an anomaly detection system
detects any device that has more than 25 connections, how many devices should be flagged as
potentially anomalous?
Solution 17. Given that the average number of connections per device is 15, we can calculate
the total number of connections in the network by multiplying the average number of connections
by the total number of devices: Total connections = 1000 devices * 15 connections/device = 15000
connections.
If the anomaly detection system flags any device with more than 25 connections as potentially
anomalous, we need to calculate how many devices in the network have more than 25 connections:
Number of flagged devices = Total connections / 25 connections/device = 15000 / 25 = 600 devices.
Therefore, 600 devices in the network should be flagged as potentially anomalous.
16 18. ADVANCED PERSISTENT THREATS (APTS)
Problem 18. An organization is investigating a potential Advanced Persistent Threat (APT)
on their network. The IT security team has identified that the attacker has been exfiltrating data
at a rate of 10 megabits per second for the past 6 months. The team estimates that the data
exfiltrated each day has a value of $500. Assuming that the organization has failed to detect the
APT, calculate the total monetary loss incurred by the organization due to this APT.
Solution 18. a) To calculate the amount of data exfiltrated in 6 months, we first convert the
data rate to megabits per day:
10 megabits per second ×3600 seconds per hour ×24 hours per day = 864,000 megabits per day
Now, we find the total data exfiltrated in 6 months:
864,000 megabits per day ×30 days per month ×6months = 155,520,000 megabits
b) The total value of data exfiltrated in one day is $500. Therefore, the total monetary loss
incurred by the organization due to this APT in 6 months is:
$500 ×155,520,000 = $77,760,000
c) Thus, the total monetary loss incurred by the organization due to this APT over the course
of 6 months is $77,760,000.
17 19. EAVESDROPPING AND WIRETAPPING
Problem 19. Consider a network where messages are encrypted using the RSA encryption
scheme with a public key (n, e) = (35,7). An eavesdropper intercepts a ciphertext c= 16. Deter-
mine the plaintext message by decrypting the ciphertext using the private key.
Solution 19. Given the public key (n, e) = (35,7), we need to find the corresponding private
key (n, d)to decrypt the intercepted ciphertext c= 16. To find the private key, we need to calculate:
1. Calculate n=p×qwhere pand qare distinct prime numbers.
Since n= 35, we need to factorize 35 into its prime factors. We have:
35 = 5 ×7
Therefore, p= 5 and q= 7.
2. Calculate ϕ(n)=(p−1) ×(q−1), which is the totient function.
ϕ(35) = (5 −1) ×(7 −1) = 4 ×6 = 24
3. Calculate the private key dsuch that e×d≡1 (mod ϕ(n)).
Using the extended Euclidean algorithm, we find d= 19 as the private key.
4. Decrypt the intercepted ciphertext c= 16 using the private key.
We use the decryption formula: m=cdmod n.
1619 mod 35
By successive squaring, we find:
162≡256 ≡6 (mod 35)
164≡62≡36 ≡1 (mod 35)
168≡12≡1 (mod 35)
1616 ≡12≡1 (mod 35)
Therefore, 1619 = 1616 ×162×16 ≡1×6×16 ≡6 (mod 35).
So, the plaintext message is 6.
18 20. ZERO-DAY EXPLOITS AND VULNERABILITIES.
Problem 20. A company’s network uses a subnet with IP addresses ranging from 192.168.1.0
to 192.168.1.255. Recently, a zero-day exploit was discovered that targets devices with IP ad-
dresses ending in .25 and .30. The company wants to deploy a rule in their intrusion detection
system to specifically monitor traffic to these vulnerable devices.
a) How many vulnerable devices are there in the subnet that will be monitored?
b) If the company deploys the rule to log traffic to these vulnerable devices for a week and it
generates an average of 1000 log entries per day, how many log entries will there be at the end of
the week?
c) If analyzing each log entry takes an average of 10 seconds and there is a team of 3 analysts
working full-time on this task, how many hours will it take them to go through the week’s worth of
logs?
Solution 20.
a) To find the number of vulnerable devices in the subnet that will be monitored, we need to
count the devices with IP addresses ending in .25 and .30.
There are 2 devices with IP ending in .25 (192.168.1.25 and 192.168.2.25) and 2 devices with
IP ending in .30 (192.168.1.30 and 192.168.2.30). Therefore, there are 2 + 2 = 4 vulnerable devices
that will be monitored.
b) The total number of log entries at the end of the week can be calculated by multiplying the
daily average by the number of days in a week:
Total log entries = 1000 log entries/day * 7 days/week = 7000 log entries
Therefore, there will be 7000 log entries at the end of the week.
c) To determine how many hours it will take the team of 3 analysts to go through the week’s
worth of logs, we need to calculate the total time taken in seconds and then convert it to hours.
Total time taken = 7000 log entries * 10 seconds/log entry = 70,000 seconds
Since there are 3 analysts working full-time, the time taken collectively will be:
Time taken per analyst = 70,000 seconds / 3 analysts = 23,333.33 seconds
Converting this to hours:
Total time taken = 23,333.33 seconds * (1 hour / 3600 seconds) 6.48 hours
Therefore, it will take the team of 3 analysts approximately 6.48 hours to go through the week’s
worth of logs.
