CVA CVA Wireless & Mobile Security Assessment 1 — Questions and Answers
Question 1: Which wireless attack involves setting up an unauthorized access point with the same SSID as the legitimate corporate network to intercept client traffic?
- Deauthentication attack
- Evil twin attack (Correct answer)
- WPS brute force
- Karma attack
Correct answer: Evil twin attack
An evil twin attack creates a rogue access point mimicking the legitimate network SSID, causing clients to connect to the attacker's AP and exposing their traffic to interception.
Question 2: What vulnerability in WPA2-Enterprise can be exploited if clients do not validate the RADIUS server certificate?
- KRACK (Key Reinstallation Attack)
- Evil twin with credential harvesting via fake RADIUS server (Correct answer)
- WPS PIN brute force
- Deauthentication flooding
Correct answer: Evil twin with credential harvesting via fake RADIUS server
If WPA2-Enterprise clients don't validate the RADIUS server certificate, an evil twin with a rogue RADIUS server can capture MSCHAPv2 credentials for offline cracking.
Question 3: During a wireless security assessment, what does the 'deauthentication attack' accomplish?
- Cracks the WPA2 pre-shared key
- Forces connected clients to disconnect from the legitimate AP, enabling capture of WPA handshakes or forcing connections to a rogue AP (Correct answer)
- Bypasses MAC address filtering
- Exploits WPS vulnerabilities to recover the PSK
Correct answer: Forces connected clients to disconnect from the legitimate AP, enabling capture of WPA handshakes or forcing connections to a rogue AP
Deauthentication attacks send spoofed 802.11 deauthentication frames to force client disconnection, triggering reconnection handshakes that can be captured for offline password cracking.
Question 4: What is the KRACK attack and which wireless security protocol does it target?
- Key Reinstallation Attack targeting WPA2, exploiting nonce reuse vulnerabilities in the 4-way handshake (Correct answer)
- Key Recovery Attack targeting WEP's RC4 stream cipher
- Key Rotation Attack targeting WPA3's SAE handshake
- Key Cracking Attack targeting WPS PIN authentication
Correct answer: Key Reinstallation Attack targeting WPA2, exploiting nonce reuse vulnerabilities in the 4-way handshake
KRACK (Key Reinstallation Attack) exploits WPA2's 4-way handshake by manipulating retransmissions to reinstall already-used keys, enabling nonce reuse and traffic decryption.
Question 5: Which tool is commonly used during wireless assessments to capture WPA/WPA2 handshakes for offline password cracking?
- Nmap
- Aircrack-ng suite (airodump-ng) (Correct answer)
- Metasploit
- Burp Suite
Correct answer: Aircrack-ng suite (airodump-ng)
The Aircrack-ng suite, specifically airodump-ng, captures wireless traffic and WPA/WPA2 handshakes, which can then be subjected to dictionary or brute-force attacks using aircrack-ng.
Question 6: During a mobile application security assessment, what does 'insecure data storage' typically involve?
- Storing large media files on the device
- Storing sensitive data (credentials, PII, tokens) in unprotected locations like shared preferences, SQLite databases, or log files accessible to other apps or physical attackers (Correct answer)
- Using insufficient device storage capacity
- Failing to implement data compression for stored files
Correct answer: Storing sensitive data (credentials, PII, tokens) in unprotected locations like shared preferences, SQLite databases, or log files accessible to other apps or physical attackers
Insecure data storage places sensitive information in unprotected locations (SharedPreferences, SQLite, log files) readable by other apps on rooted/jailbroken devices or through physical access.
CVA CVA Wireless & Mobile Security Assessment 1
Which wireless attack involves setting up an unauthorized access point with the same SSID as the legitimate corporate network to intercept client traffic?