CVA Wireless & Mobile Security Assessment Flashcards

What is a 'rogue access point' and what risk does it present in an enterprise wireless assessment?

Answer: An unauthorized wireless access point installed on the network that bypasses security controls, creating an unmonitored entry point

Rogue access points are unauthorized APs connected to the corporate network — intentionally or by employees for convenience — creating unmonitored network entry points that bypass perimeter security.

During a mobile application assessment, what is the risk of 'improper certificate validation' (certificate pinning bypass)?

Answer: The application accepts invalid or attacker-controlled TLS certificates, enabling man-in-the-middle interception of encrypted traffic

Improper certificate validation or absent certificate pinning allows attackers to intercept HTTPS traffic by presenting forged or attacker-controlled certificates to the mobile application.

What is 'Bluetooth Low Energy (BLE) sniffing' and why is it assessed during wireless security testing?

Answer: Intercepting BLE communications between devices to analyze unencrypted data transmissions or protocol weaknesses

BLE sniffing captures communications between BLE devices, revealing unencrypted data, authentication mechanisms, and potential vulnerabilities in IoT devices, wearables, and access controls.

In mobile application testing, what does 'reverse engineering the APK' allow an assessor to identify?

Answer: Hardcoded credentials, API keys, insecure cryptographic implementations, and application logic flaws within the decompiled source code

Reverse engineering an APK using tools like jadx or apktool reveals decompiled source code where hardcoded secrets, API keys, insecure logic, and cryptographic weaknesses can be discovered.

What does 'WPS (Wi-Fi Protected Setup) brute force' target and why is it a significant wireless vulnerability?

Answer: The 8-digit WPS PIN, which due to its split validation design is vulnerable to brute force in approximately 11,000 attempts rather than 100 million

WPS PIN validation occurs in two halves of 4 digits each, reducing the effective keyspace to ~11,000 combinations; successful brute force reveals the full WPA2 PSK regardless of its complexity.

During a wireless assessment, you identify an access point broadcasting WEP. Why is this considered a critical vulnerability?

Answer: WEP's RC4 implementation has fundamental cryptographic weaknesses that allow the encryption key to be recovered in minutes using passive traffic capture

WEP's RC4 implementation reuses initialization vectors, allowing statistical analysis of captured packets to recover the encryption key in minutes using tools like aircrack-ng.