Final Exam
CIS 459/659 – 5/23/05
______________________________________
Name
/100
Points
First read all the questions carefully and plan your time. It may be good strategy to start with
those questions you know well and leave hard ones for the end. In case when you are not sure
of the answer, write down what you think – you may receive partial credit for it if it is
correct.
There is plenty of space after each question but you needn’t use all of it. Give short, concise,
targeted answers to each question but be sure to list key points.
1. (10 points)
What is a vulnerability? What is an exploit? What can the attacker achieve by exploiting a
vulnerability?
2. (10 points)
I am designing a cryptographic protocol to protect communication between two bank branches.
There are two types of messages that will be sent between banks: “Withdraw X dollars from
account Y”, and “Credit Z dollars to account W”, where X, Y, Z and W can take any integer values.
My simple protocol will take a message and encrypt it with a shared key. How can a man-in-themiddle attack be perpetrated against this protocol (assume that key is perfectly secret)? List all the
possible threats from man-in-the-middle attack. Now describe how the protocol should be amended
to handle each threat – make sure to pair threats with defense measures.
3. (10 points)
Describe Diffie-Hellman shared key exchange. Now describe man-in-the-middle attack on this key
exchange. How can this attack be handled?
4. (10 points)
What is a stack-based overflow? Describe how it works in detail and suggest one defense against it.
5. (10 points)
What are rootkits? How can they be used to cover attacker’s traces? How can we detect a rootkit?
6. (10 points)
What are reflector DDoS attacks? Give an example of how a reflector attack could be perpetrated
against a target and discuss why this type of an attack is more difficult to handle than a classical
zombie-flooding DDoS attack.
7. (10 points)
Describe how puzzles can be used for DDoS protection? What are the advantages and drawbacks of
this type of defense? Give an example of an attack that cannot be handled using puzzles.
8. (10 points)
Describe an approach used in C. C. Zou, W. Gong, D. Towsley, and L. Gao. "The Monitoring and
Early Detection of Internet Worms". You needn’t specify any formulas, just describe the general
idea. Now discuss advantages and disadvantages of the proposed approach.
9. (10 points)
Why is IP spoofing dangerous? Briefly explain any two filtering approaches to counter IP spoofing
and discuss their advantages and disadvantages.
10. (10 points)
What knowledge can we obtain from (a) low-interaction honeypots, (b) high-interaction honeypots?
What are the risks involved in hosting high-interaction honeypots? Why are these risks lower for
low-interaction honeypots?