CVA Wireless & Mobile Security Assessment Flashcards

Which wireless attack involves setting up an unauthorized access point with the same SSID as the legitimate corporate network to intercept client traffic?

Answer: Evil twin attack

An evil twin attack creates a rogue access point mimicking the legitimate network SSID, causing clients to connect to the attacker's AP and exposing their traffic to interception.

What vulnerability in WPA2-Enterprise can be exploited if clients do not validate the RADIUS server certificate?

Answer: Evil twin with credential harvesting via fake RADIUS server

If WPA2-Enterprise clients don't validate the RADIUS server certificate, an evil twin with a rogue RADIUS server can capture MSCHAPv2 credentials for offline cracking.

During a wireless security assessment, what does the 'deauthentication attack' accomplish?

Answer: Forces connected clients to disconnect from the legitimate AP, enabling capture of WPA handshakes or forcing connections to a rogue AP

Deauthentication attacks send spoofed 802.11 deauthentication frames to force client disconnection, triggering reconnection handshakes that can be captured for offline password cracking.

What is the KRACK attack and which wireless security protocol does it target?

Answer: Key Reinstallation Attack targeting WPA2, exploiting nonce reuse vulnerabilities in the 4-way handshake

KRACK (Key Reinstallation Attack) exploits WPA2's 4-way handshake by manipulating retransmissions to reinstall already-used keys, enabling nonce reuse and traffic decryption.

Which tool is commonly used during wireless assessments to capture WPA/WPA2 handshakes for offline password cracking?

Answer: Aircrack-ng suite (airodump-ng)

The Aircrack-ng suite, specifically airodump-ng, captures wireless traffic and WPA/WPA2 handshakes, which can then be subjected to dictionary or brute-force attacks using aircrack-ng.

During a mobile application security assessment, what does 'insecure data storage' typically involve?

Answer: Storing sensitive data (credentials, PII, tokens) in unprotected locations like shared preferences, SQLite databases, or log files accessible to other apps or physical attackers

Insecure data storage places sensitive information in unprotected locations (SharedPreferences, SQLite, log files) readable by other apps on rooted/jailbroken devices or through physical access.