Cloud, Mobile, and IoT Security

This chapter covers the following topics related to Objective 3.4 (Given a scenario, research attack vectors and perform attacks on cloud technologies.) and Objective 3.5 (Explain common attacks and vulnerabilities against specialized systems.) of the CompTIA PenTest+ PT0-002 certification exam:

• Researching attack vectors and performing attacks on cloud technologies

• Explaining common attacks and vulnerabilities against specialized systems

The adoption of cloud technology and cloud services has revolutionized how organizations develop, host, and deploy applications and store data. In addition, mobile devices and Internet of Things (IoT) devices communicate using a diverse set of protocols and technologies. Mobile and IoT devices also often communicate with applications hosted in the cloud. All these technologies and architectures increase the attack surface and introduce a variety of cybersecurity risks. In this chapter, you will learn about different attacks against cloud, mobile, and IoT implementations.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read this entire chapter thoroughly or jump to the “Exam Preparation Tasks” section. If you are in doubt about your answers to these questions or your own assessment of your knowledge of the topics, read the entire chapter. Table 7-1 lists the major headings in this chapter and their corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Q&A Sections.”

Table 7-1 “Do I Know This Already?” Section-to-Question Mapping

1. Which of the following is the process of gathering and stealing valid usernames, passwords, tokens, PINs, and other types of credentials through infrastructure breaches?

   1. Password cracking

   2. Key reauthentication attack

   3. Crypto downgrade attack

   4. Credential harvesting

2. You were tasked with performing a penetration assessment of a cloud-hosted application. After compromising the osantos user account, you were then able to access functions or content reserved for another user, ccleveland. Which of the following best describes this type of attack?

   1. Cloud lateral movement

   2. VM escape

   3. Sandbox escape

   4. Horizontal privilege escalation

3. Which of the following are potential ways to detect account takeover attacks? (Choose all that apply.)

   1. Analyzing failed attempts

   2. Looking for abnormal OAuth, SAML, or OpenID Connect connections

   3. Monitoring for abnormal file sharing and downloading

   4. All of these answers are correct.

4. When performing a cloud-based penetration test, you noticed that a software developer included sensitive information in user startup scripts. Through which of the following could these user startup scripts be accessed and allow cloud-based instances to be launched with potential malicious configurations?

   1. Block storage

   2. Lambda

   3. Metadata services

   4. None of these answers are correct.

5. Which of the following is an example of a vulnerability that could allow an attacker to launch a side-channel attack in a cloud infrastructure?

   1. Heartbleed

   2. DNS cache poisoning

   3. Spectre

   4. None of these answers are correct.

6. Which of the following is a mandatory access control mechanism describing the resources that a mobile app can and can’t access?

   1. Container

   2. IPC

   3. Sandbox

   4. None of these answers are correct.

7. Which of the following are vulnerabilities that could affect a mobile device? (Choose all that apply.)

   1. Insecure storage vulnerabilities

   2. Vulnerabilities affecting biometrics integrations

   3. Certificate pinning

   4. All of these answers are correct.

8. Which of the following is a tool that can be used to find vulnerabilities in Android implementations and attack the underlying operating system?

   1. Drozer

   2. Nmap

   3. Nikto

   4. MobSF

9. Which of the following is an automated mobile application and malware analysis framework?

   1. Postman

   2. Bettercap

   3. MobSF

   4. Ettercap

10. Which of the following management interface implementations can be leveraged by an attacker to obtain direct access to a system’s motherboard and other hardware?

    1. IPMC implants

    2. UEFI bus

    3. BIOS

    4. IPMI baseboard management controller