Certified Ethical Hacker (CEH)

Certification Crash Course

(Day 2)

Omar Santos
@santosomar
theartofhacking.org
What we covered yesterday (DAY 1)

Introduction to Ethical Hacking and to the CEHv10 exam

Foot-printing, Enumeration, Reconnaissance, and Network Scanning

Vulnerability Analysis and System Hacking

Social Engineering

Denial-of-Service

Session Hijacking, Evading IDS, IPS, Firewalls, and Honeypots

theartofhacking.org
DAY 2

Cryptography

Hacking Wireless Networks

Hacking Web Servers and Web Applications

Hacking Mobile Platforms

IoT Hacking

Cloud Computing

theartofhacking.org
 DISCLAIMER | WARNING

The information provided on this training is for educational purposes only. The
author, O’Reilly, or any other entity is in no way responsible for any misuse of
the information.

Some of the tools and technologies that you will learn in this training class may be
illegal depending on where you reside. Please check with your local laws.

Please practice and use all the tools that are shown in this training in a lab that is not
connected to the Internet or any other network.
theartofhacking.org
What this class is and is not…

• This is a review class of the CEHv10 exam and an

introduction to the CEHv11.
• This training helps you prepare for the test; it does not
guarantee that you will pass.
• We will cover all major topics covered in the CEHv10
and CEHv11 exams. You still need to practice, study,
and learn from other resources.

theartofhacking.org
 Resources:
CEH Review: https://cehreview.com
The Art of Hacking: https://theartofhacking.org
GitHub: https://theartofhacking.org/github theartofhacking.org
https://cehreview.com theartofhacking.org
https://learning.oreilly.com/videos/certified-ethical-hacker/9780135647455

theartofhacking.org
https://learning.oreilly.com/certifications/9780136758433

theartofhacking.org
Cryptography

theartofhacking.org
 The word cryptography or cryptology
comes from the Greek word kryptós,
What is which means a secret.
Cryptography?
It is the study of the techniques used for
encryption and secure communications.

theartofhacking.org
 Cryptographers are always constructing
and analyzing protocols for preventing
unauthorized users from reading private
messages as well as the following areas
Why of information security:
Cryptography?
• Data confidentiality
• Data integrity
• Authentication
• Nonrepudiation
theartofhacking.org
 • Virtual private networks (VPNs)
Examples of the • Ecommerce
use of • Secure email transfer
cryptography • Credit card chips
• many more…

theartofhacking.org
 What is …the study of how to crack encryption
cryptanalysis? algorithms or their implementations.

theartofhacking.org
 A cipher is a set of rules, which can also
Ciphers be called an algorithm, about how to
perform encryption or decryption.

theartofhacking.org
 This type of cipher substitutes one
Substitution character for another.

theartofhacking.org
theartofhacking.org
theartofhacking.org
 This is similar to substitution, but instead
of using a single alphabet, it can use
Polyalphabetic multiple alphabets and switch between
them by some trigger character in the
encoded message.

theartofhacking.org
 This method uses many different options,
including the rearrangement of letters.

Transposition
T S S R
H I E E
I S C T
theartofhacking.org
 Encryption algorithms can operate on
Block and Stream
blocks of data at a time, or bits and bytes
Ciphers of data, based on the type of cipher.

theartofhacking.org
 A block cipher is a symmetric key cipher
(meaning the same key is used to encrypt
and decrypt) that operates on a group of
bits called a block.
Block Ciphers Examples:
• Advanced Encryption Standard (AES)
• Triple Digital Encryption Standard (3DES)
• Digital Encryption Standard (DES)
• Blowfish
• International Data Encryption Algorithm (IDEA)

theartofhacking.org
 A stream cipher is a symmetric key cipher
(meaning the same key is used to encrypt
and decrypt), where the plaintext data to
Stream Ciphers be encrypted is done a bit at a time
against the bits of the key stream, also
called a cipher digit stream.

theartofhacking.org
 A symmetric encryption algorithm, also
Symmetric known as a symmetric cipher, uses the
Algorithms same key to encrypt the data and decrypt
the data.

theartofhacking.org
 An example of an asymmetric algorithm is a
public key algorithm.

There is something magical about asymmetric

algorithms because instead of using the same key
Asymmetric for encrypting and decrypting, they use two
different keys that mathematically work together
Algorithms as a pair.

Examples: RSA, Diffie-Hellman, DSA, ElGamal

theartofhacking.org
 EVE
DEREK HANNAH

theartofhacking.org
 • Hashing is a method used to verify data
integrity.

• A cryptographic hash function is a process that

Hashes takes a block of data and creates a small fixed-
sized hash value.

• It is a one-way function.

theartofhacking.org
 • Individuals and organizations deploy VPNs to
provide data integrity, authentication, and data
encryption to ensure confidentiality of the
packets sent over an unprotected network or
the Internet.
• VPNs are designed to avoid the cost of
What Are unnecessary leased lines.
• Individuals also use VPNs to remain
VPNs? anonymous online.
• Even threat actors use VPN technologies to
encrypt data from compromised sites,
command and control communications, and to
maintain anonymity for the purposes of
malfeasance in underground sites and darknet
marketplaces.
theartofhacking.org
 • Point-to-Point Tunneling Protocol (PPTP)
• Layer 2 Forwarding (L2F) protocol
Example VPN •
•
Layer 2 Tunneling Protocol (L2TP)
Generic Routing Encapsulation (GRE)
Technologies • Multiprotocol Label Switching (MPLS)
• Internet Protocol Security (IPsec)
• Secure Sockets Layer (SSL)

theartofhacking.org
Site-to-Site
VPNs

theartofhacking.org
Remote Access
VPNs

theartofhacking.org
Additional Crypto Details and References:
https://cehreview.com/go/crypto

theartofhacking.org
Hacking Wireless Networks

theartofhacking.org
A few questions before we get started…

theartofhacking.org
Which of the following best describes an attack where the threat
actor creates a rogue access point and configures it exactly the
same as the existing wireless network?

a) Evil Twin

a) Wireless Twin

a) Evil AP

a) Rogue Twin Client

theartofhacking.org
Whiteboard
Explanation of
Rogue and Evil
Twins

theartofhacking.org
Whiteboard
Explanation of
DeAuth Attacks

theartofhacking.org
DeAuth

theartofhacking.org
Which of the following is a methodology used by attackers
to find wireless access points wherever they may be?

a) Active wireless injection

a) Wireless Driving

a) War Driving

a) Evil Twin

theartofhacking.org
 Which of the following is true about WEP?

a) WEP keys exists in two sizes: 48-bit (5 byte) and 104-bit (13 byte). In addition, WEP uses a 40-bit
initialization vector (IV), which is prepended to the pre-shared key (PSK). When you configure a
wireless infrastructure device with WEP the IVs are sent in the clear.

a) WEP keys exists in two sizes: 40-bit (5 byte) and 104-bit (13 byte). In addition, WEP uses a 40-bit
initialization vector (IV), which is prepended to the pre-shared key (PSK). When you configure a
wireless infrastructure device with WEP the IVs are sent encrypted with RC4.

a) WEP keys exists in two sizes: 40-bit (5 byte) and 104-bit (13 byte). In addition, WEP uses a 24-bit
initialization vector (IV), which is prepended to the pre-shared key (PSK). When you configure a
wireless infrastructure device with WEP the IVs are sent encrypted with AES.

a) WEP keys exists in two sizes: 40-bit (5 byte) and 104-bit (13 byte). In addition, WEP uses a 24-bit
initialization vector (IV), which is prepended to the pre-shared key (PSK). When you configure a
wireless infrastructure device with WEP the IVs are sent in the clear.

theartofhacking.org
Which of the following is an attack against the WPA and
WPA2 protocols?

a) KRACK

a) WPA Buster

a) Initialization Vector KRACK

a) Four-way handshake injection

theartofhacking.org
 Which of the following describes a KARMA attack?

a) KARMA is a man-in-the-middle attack in wired networks allowing an attacker

to intercept traffic.

a) KARMA is an evasion attack that creates a rogue AP allowing an attacker to

intercept wireless traffic.

a) KARMA is command injection attack that creates a rogue router allowing an

attacker to inject malicious wireless traffic.

a) KARMA is a man-in-the-middle attack that creates a rogue AP allowing an

attacker to intercept wireless traffic.

theartofhacking.org
 WEP Deficiencies

• WEP is susceptible to many different attacks and it is considered an obsolete

wireless protocol.

• WEP must be avoided and many wireless network devices no longer support it.

• WEP keys exists in two sizes: 40-bit (5 byte) and 104-bit (13 byte).

• In addition, WEP uses a 24-bit initialization vector (IV), which is prepended to the
pre-shared key (PSK). When you configure a wireless infrastructure device with
WEP, the IVs are sent in the clear.

theartofhacking.org
 More WEP Problems

• WEP has been defeated for decades.

• WEP uses RC4 in a manner that allows an attacker to crack the PSK with little
effort. The problem is how WEP uses the IVs in each packet.
• When WEP uses RC4 to encrypt a packet, it prepends the IV to the secret key
before including the key into RC4.
• Subsequently, the attacker has the first three bytes of an allegedly “secret” key
used on every packet. In order to recover the PSK, you just need to collect
enough data from the air.
• You can accelerate this attack by just injecting ARP packets (because the length
is predictable) allowing you to recover the PSK much faster.
• After you recover the WEP key, you can use it to access the wireless network.

theartofhacking.org
WPA Handshake

theartofhacking.org
theartofhacking.org
 Attacking the Preferred Network Lists

• Operating systems and wireless supplicants (clients), in many cases, maintain

a list of trusted or preferred wireless networks. This is also referred to as the
preferred network list (PNL).
• This list includes the wireless network SSID, clear text passwords or WEP or
WPA passwords.
• Clients use these preferred networks to automatically associate to wireless
networks when they are not connected to an AP or a wireless router.
• You can listen to these client requests and impersonate such wireless networks
in order to make the clients connect to your wireless device and eavesdrop in
their conversation or to manipulate their communication.

theartofhacking.org
theartofhacking.org
 Wireless Networks, IoT, and Mobile Devices Hacking
(video course with tons of demos – FREE with Safari Subscription)

https://cehreview.com/go/wireless

theartofhacking.org
Buffer Overflows

theartofhacking.org
Introduction to Buffer Overflows
theartofhacking.org
H E L L O

H E L L O W O R L
D

theartofhacking.org
heap

theartofhacking.org
heap

theartofhacking.org
 EIP
• The Instruction pointer register.
• Stores the address of the next instruction to be executed.
• Its value is incremented after every instruction execution
(depending on the size of an instruction).

theartofhacking.org
 ESP
• The Stack pointer register.
• Stores the address of the top of the stack. This is the
address of the last element on the stack.
• The stack grows downward in memory(from higher
address values to lower address values).
• Subsequently, ESP points to the value in stack at the
lowest memory address.

theartofhacking.org
 EBP
• The Base pointer register.
• The EBP register usually set to ESP at the start of the
function.
• This is done to keep tab of function parameters and local
variables.
• Local variables are accessed by subtracting offsets
from EBP and function parameters are accessed by
adding offsets to it.

theartofhacking.org
,

theartofhacking.org
 WHAT IS SHELLCODE?

A small set of instructions (piece of

code) used as the payload in the
exploitation of a vulnerability, such
as a buffer overflow.

theartofhacking.org
https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom theartofhacking.org
theartofhacking.org
Hacking Web Servers and
Web Applications

theartofhacking.org
 Web Application
Penetration Testing
Methodologies

theartofhacking.org
https://www.owasp.org/index.php/OWASP_Testing_Project theartofhacking.org
theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only
All part of https://www.owasp.org/index.php/OWASP_Testing_Project
theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 * For your reference only

All part of https://www.owasp.org/index.php/OWASP_Testing_Project

theartofhacking.org
 Exploring How Web
Applications Have Evolved
Over Time

theartofhacking.org
What is a Web Application?

theartofhacking.org
THE TRADITIONAL WEB APPLICATION ARCHITECTURE

theartofhacking.org
theartofhacking.org
theartofhacking.org
OPENID AUTHENTICATION FLOW

theartofhacking.org
WEBHOOK MODE EXAMPLE REQUEST

WEBHOOK MODE
EXAMPLE RESPONSE

theartofhacking.org
Understand how Gather needed
the application information
works • credentials, tokens,
• Purpose (e.g. app API configurations
configuration)
• Functions (e.g.
account
provisioning)

Break the Allot time to reset

application to the application &
manageable purge backend
chunks database
• Large app scans can • Scans inject bad
take hours data
• Functional breakout • Can use VM
(admin, reporting) snapshots

theartofhacking.org
theartofhacking.org
 Packet Tampering

Packet Sniffing / MiTM XML Injection

XSS

CSRF
Click-Jacking
Directory
Traversal
FORGED TOKEN

DIRECT OBJECT
REFERENCE

SQL Injection

theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
Dozens of vulnerable applications,
VMs, and websites that you can use
to practice your skills.

https://theartofhacking.org/lab

theartofhacking.org
https://theartofhacking.org/github

theartofhacking.org
 Mobile testing Lab Setup
Android/iOS Emulator
Burpsuite
Proxy all emulator traffic through Burpsuite to web service

theartofhacking.org
 Reconnaissance and
Profiling Web Applications

theartofhacking.org
Typical Web Attack/Test Process

Reconnaissance • Find out as much information as you can

• What web service is running
• What kind of code is it using

• Crawl or spider the web application

Mapping/Discovery
• Manually walk through the web application

• Validate that the vulnerability is exploitable

Exploitation • Gain foothold
• Steal data

theartofhacking.org
Web Application Mapping
Techniques

Manual crawl
Walking through the
application one page at a time

Hybrid approach
Use an automated scanner,
but tell it were to look

Automated
crawl/spidering
Point and click
Use an automated scanner

theartofhacking.org
Vulnerability Discovery

Manual Testing Automated scanning Hybrid

Try different input and see Use a web scanning Use an automated scanner
how the application reacts application to probe for as well as manual testing
vulns

theartofhacking.org
Automated Scanning

theartofhacking.org
How Automated Web Scanners Work

Give the Probe for

application a possible Sometimes
starting point vulns exploit

Crawl the Send attack Report

application strings to findings
links

theartofhacking.org
Verification of Results
Is it really a vulnerability, or just a false positive?

Analyze the requests and responses

Review the responses you get back from the web server to
find any indication of a successful attack

Exploit the vulnerability

If the response does not give you enough
information then you can always run the
exploit.
Run the attack again
You may need to run the attack again
manually and monitor the response

theartofhacking.org
Interception Proxy

theartofhacking.org
How an Interception Proxy Works

FIRST SECOND THIRD FOURTH FIVE

STEP STEP STEP STEP STEP

Automated attacks Manual attacks

Proxy can see all
Browser connects Proxy can intercept can be run based can be run using
traffic from browser
to proxy and modify traffic on the collected collected requests
to web server
traffic and responses

theartofhacking.org
 Authentication and
Session Management
Vulnerabilities

theartofhacking.org
theartofhacking.org
theartofhacking.org
 There are several ways that an attacker can perform a session
hijack and where a session token could be compromised:
❑ Predicting session tokens: this is why it is important to use non-
predictable tokens, as previously discussed in this section.
❑ Session sniffing: by collecting packets of unencrypted web
sessions.
❑ Man-in-the-middle attacks: where the attacker sits in the path
between the client and the web server.
❑ Man-in-the-browser attack: similar approach as man-in-the-middle
attacks; however, in this case browser (or extension or plugin) is
compromised and used to intercept and manipulate web sessions
between the user and the web server.

theartofhacking.org
 Cross-site Scripting (XSS)
&
Cross-site Request Forgery
(CSRF)

theartofhacking.org
theartofhacking.org
theartofhacking.org
 You typically find XSS vulnerabilities in:

▪ Search fields that echo a search string back

to the user
▪ HTTP headers
▪ Input fields that echo user data
▪ Error messages that return user supplied text
▪ Hidden fields that may include user input data
▪ Applications (or websites) that displays user-
supplied data
theartofhacking.org
theartofhacking.org
DEMO – XSS
theartofhacking.org
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

theartofhacking.org
Cross-site request forgery (CSRF or
XSRF) attacks occur when
unauthorized commands are
transmitted from a user that is
trusted by the application.

CSRF is different from XSS because it

exploits the trust that an application
has in a user’s browser.
theartofhacking.org
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

theartofhacking.org
 UserName
= Santos’;drop table
users; truncate
audit_log;--

Introduction to Hacking Databases

theartofhacking.org
 Source: OWASP

https://www.owasp.org/index.php/Injection_Prevention_Cheat_Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
theartofhacking.org
When does SQL injection happen?

theartofhacking.org
Data is not validated, filtered, or sanitized by
the application.
theartofhacking.org
When bad data is used within object-relational
mapping (ORM) search parameters to extract
additional, sensitive records.
theartofhacking.org
Data is not validated, filtered, or sanitized by
the application.
theartofhacking.org
 Used to access files and directories that are
stored outside the web root folder.

File Inclusion You can manipulate variables that reference files

and Directory with “dot-dot-slash (../)” or by using absolute file
paths.
Traversal
You may be able access arbitrary files and
directories stored on file system including
application source code or configuration and
critical system files, like the /etc/passwd
theartofhacking.org
DEMO – Directory/Path
Traversal
theartofhacking.org
 Poorly configured XML parsers evaluate
external entity references within XML
docs.
XML
External External entities can be used to:
* disclose internal files using the file URI handler
Entity (XXE) * internal file shares
* internal port scanning
* remote code execution
* denial of service attacks.

theartofhacking.org
DEMO – XXE
theartofhacking.org
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

theartofhacking.org
DEMO – ZAP
theartofhacking.org
Which of the following is NOT an example of an HTTP method?

a) PUT

a) DELETE

a) TRACE

a) REST

theartofhacking.org
Which of the following are examples of code injection
vulnerabilities?

a) SQL injection

a) HTML script injection

a) Object injection

a) All of the above

theartofhacking.org
Refer to the following string:
omar' or '1'=‘1
This string is an example of what type of attack?

a) XSS
b) XSRF
c) CSRF
d) SQL Injection

theartofhacking.org
 Which of the following is not true?

a) Once an authenticated session has been established, the session ID (or token) is
temporarily equivalent to the strongest authentication method used by the application, like
username and passwords, one-time passwords, client-based digital certificates, and
others.

a) The the session ID (or token) is temporarily equivalent to the strongest authentication
method used by the application prior to authentication.

a) The session ID is a “name=value” pair.

a) a and c are not true

theartofhacking.org
What type of vulnerabilities can be triggered by using the
parameters in the following URL?

http://store.h4cker.org/?search=cars&results=20&search=bikes

a)XSS
b)SQL injection
c) HTTP Parameter Pollution (HPP)
d)Command injection

theartofhacking.org
What type of vulnerabilities can be triggered by using the
parameters in the following URL?

http://web.h4cker.org/changepassd?user=omar

a) SQL injection
b) Insecure Direct Object Reference
c) Indirect Object Reference
d) XSS

theartofhacking.org
BONUS: What type of vulnerabilities can be triggered by
using the following string?

<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&
#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#
x53&#x53&#x27&#x29>

theartofhacking.org
Hacking Mobile Platforms

theartofhacking.org
What you need to know…

• Mobile platforms attack vectors

• Android threats and attacks
• iOS threats and attacks
• Mobile spyware
• Mobile Device Management (MDM)
• Mobile security guidelines and security tools
• Overview of mobile penetration testing

theartofhacking.org
Overview of OWASP Mobile Top 10
https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10

theartofhacking.org
https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10
theartofhacking.org
https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10
theartofhacking.org
Other Client-based Attacks Still Apply

• Phishing
• Framing (iFrame-based attacks)
• Clickjacking
• Man-in-the-mobile / Man-in-the-browser
• Buffer overflows
• Data Caching
• XSS / CSRF
• Brute-force
• Weak input validation
• Command execution

theartofhacking.org
Phone / Device Specific

• Baseband attacks (GSM/3GPP)

• SMS Phishing (SMiShing)
• Jailbroken / Rooted Devices
• Mobile Malware
• Insecure App Stores
• Sensitive Data Storage
• No Encryption / Weak Encryption
• Improper SSL/TLS Validation
• Configuration Manipulations via in secure Apps
• Dynamic Runtime Injection
• Unintended Permissions
• Privilege Escalation

theartofhacking.org
App Sandboxing Issues

Sandbox Sandbox
APP
APP

User Systems
User Systems
Data Resources
Data Resources

theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
IOS TESTING GUIDE
https://github.com/OWASP/owasp-mstg#ios-testing-guide

theartofhacking.org
ANDROID SECURITY
https://source.android.com/security/

theartofhacking.org
theartofhacking.org
theartofhacking.org
Additional Resources for Mobile Device Security

• Mobile Device Security:

https://cehreview.com/go/mobile_device_security

• Hacking Android
https://cehreview.com/go/hacking_android

• Hacking iOS
https://cehreview.com/go/hacking_ios

theartofhacking.org
https://cehreview.com/mobile-api-lab.pdf
theartofhacking.org
IoT Hacking

theartofhacking.org
IoT or IoE?

Internet of Everything
(IoE) is another term
that refers to IoT
devices, processes,
and people.

theartofhacking.org
Examples of IoT Components

• Sensors / Sensing Technology

• IoT Gateways (Fog edge devices)
• Cloud Services and Storage
• Remote Control Using Mobile Apps

theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
theartofhacking.org
EC-Council IoT Architecture Terms

• Edge Technology Layer (sensors, RFID tags, wearables,

readers, etc.)
• Access Gateway Layer (bridge gap between endpoints
and other components like cloud services)
• Internet Layer
• Middleware Layer
• Application Layer

theartofhacking.org
theartofhacking.org
Short-range Wireless Medium-range Long-range Wireless Wired IoT Operating Systems
Wireless Communication
• Bluetooth Low Energy • Ha-Low • Low-power Wide- • Ethernet • RIOT OS
(BLE) area Networking
• LTE-Advanced (LPWAN): • Multimedia over • ARM mbed OS
• Light-Fidelity (LiFi) o LoRaWAN Coax Alliance
o Sigfox (MoCA) • RealSense OS X
• Near Field o Neul
Communication (NFC) • Power-line • Nucleous RTOS
• Very Small Aperture Communication
• QR Codes and Terminal (VSAT) (PLC) • Brillo
Barcodes
• Cellular • INSTEON • Contiki
• Radio Frequency
Identification (RFID) • Zephyr

• Thread • Ubuntu Core

• Wi-Fi and Wi-Fi Direct • Integrity RTOS

• Z-wave • Apache Mynewt

• Zigbee
theartofhacking.org
Security Challenges

2 in 5 Executives say privacy and security restrict IoT investment

Changing Dynamics Reducing Complexity Speeding Innovation Talent Shortage

theartofhacking.org
 • Why are so many insecure devices on the
Flawed, market?
• A Manufacturer’s Perspective
Insecure • The Device Production Cycle
Devices • Software development in an agile market
• Clash of Cultures
• Developers and the Security Puzzle

theartofhacking.org
 • Security and product confidence
• Me-too manufacturing
Plug n’ Pray • Cutting development costs
• Security is not an extra

theartofhacking.org
DETAILED REVIEW OF IOT
TECHNOLOGIES AND
SECURITY FLAWS
https://cehreview.com/go/iot

theartofhacking.org
Challenges of IoT

theartofhacking.org
OWASP IoT Project Demo

https://cehreview.com/go/owasp-iot.html

theartofhacking.org
OWASP IoT Testing Guide Demo
https://cehreview.com/go/owasp-iot-testing-guide.html

theartofhacking.org
Cloud Computing

theartofhacking.org
 Infrastructure-as-a-Service (IaaS)
SYS ADMINS • VMs, containers, and other abstracted hardware typically
controlled via APIs.
• Examples AWS (EC2), Azure, Rackspace, Google Cloud,
etc.
Platform-as-a-Service (PaaS)
DEVELOPERS • Dev tools, configuration management, deployment platforms.
• Examples Intel MashMaker, Google App Engine, Salesforce,
Azure, AWS, etc.

Software-as-a-Service (Saas)
END USERS /
CUSTOMERS • Software services to subscribers.
• Examples, Salesforce CRM, Google Docs/Drive, G-Suite,
WebEx, etc.

theartofhacking.org
 NIST SP 800-145
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

theartofhacking.org
 NIST SP 500-322
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-322.pdf

theartofhacking.org
Cloud Computing Reference Architecture

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-322.pdf theartofhacking.org
Hybrid Cloud

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-322.pdf theartofhacking.org
 NIST SP 500-291 v2

https://www.nist.gov/sites/default/files/documents/itl/cloud/NIST_SP-500-291_Version-2_2013_June18_FINAL.pdf

theartofhacking.org
Cloud “Actors”

https://www.nist.gov/sites/default/files/documents/itl/cloud/NIST_SP-500-291_Version-2_2013_June18_FINAL.pdf theartofhacking.org
Cloud Service Orchestration

https://www.nist.gov/sites/default/files/documents/itl/cloud/NIST_SP-500-291_Version-2_2013_June18_FINAL.pdf theartofhacking.org
Technical Requirements

https://www.nist.gov/sites/default/files/documents/itl/cloud/NIST_SP-500-291_Version-2_2013_June18_FINAL.pdf theartofhacking.org
The Combined Conceptual Reference Diagram

theartofhacking.org
A broader perspective…

theartofhacking.org
Application Portability and Interoperability Is the Key

Traditional Cloud Native

Applications
Saa
S
Applications
ERP, Financial, Iaa
Paa
IoT, Big Data, Analytics,
Client/Server, CRM, email, S S
Gaming, ...
…

Data Center Cloud Edge / IoT

theartofhacking.org
Cloud Computing Threats

theartofhacking.org
 Penetration • Different policies depending on the provider.
• Testing boundaries.
Testing in the • Some cloud providers allow for you to run
Cloud your tools from the cloud infrastructure itself.

theartofhacking.org
 • Cloud Firewalls
Cloud Security • Cloud DLP
• Cloud Threat Intelligence
Services • Cloud Access Security Broker (CASB)

theartofhacking.org
https://cloudsecurityalliance.org
theartofhacking.org
Which of the following is a government-wide program
that provides a standardized approach to security
assessment, authorization, and continuous monitoring
for cloud products and services?

a) FedRAMP
b) NIST Cloud Architecture
c) Cloud Security Alliance
d) NIST Cloud Certification

theartofhacking.org
In NIST Cloud Computing Reference Architecture, which
of the following is the intermediary for providing
connectivity between the cloud and the subscriber?

a) Cloud Provider
b) Cloud Broker
c) Cloud Auditor
d) Cloud Carrier

theartofhacking.org
Which of the following are considered threats to cloud
computing?

a) Data Breaches
b) Abuse of Services
c) Insiders
d) Insecure Interfaces
e) A and B
f) A, B, C, and D

theartofhacking.org
An attacker sets up a VM on the same physical cloud
host as the target’s VM. He then takes advantage of
the shared physical resources to steal data. Which of
the following describes this attack?

a) VM Escape
b) Side Channel
c) VM Flood
d) Session Riding
e) Cloud Squatting

theartofhacking.org
Which of the following is used in a session-riding
attack?

a) Denial of Service (DoS)

b) Man-in-the-Middle
c) VM Escape
d) Cross-site Scripting (XSS)
e) Cross-site Request Forgery (CSRF)

theartofhacking.org
 Thank you!
Don’t forget to check out your other resources:

• Ethical Hacking Video on Demand: https://theartofhacking.org

• Other Cybersecurity Live Training: https://theartofhacking.org/training
• Additional Resources: https://theartofhacking.org/resources

theartofhacking.org