How Much do you know about Cyber Security Quiz

[Markverhyden]

I got 9/10 because of their expanded definition of phishing. Also, this one is a bit ambiguous:

You could enter a password into a portal to gain access to an unencrypted WiFi network. Or you could enter a "password" aka encryption key to join a WPA2 network. If the former that is certainly less secure. But either way, how would using either for online banking be insecure in that situation?

There is not a single bank website that doesn't use SSL (that I know of). So all traffic between the browser and the server is secure. Are there man in the middle attacks that make that insecure? How else is that insecure?

I think their point is just because there is a password does not mean it's secure. As you mentioned a site can require a password to access an unencrypted connection to a WLAN which is meaningless except to try to keep out wardriving. The rest of the session is not encrypted so it could be recorded. MITM stuff? Yes, it's out there and it's not trivial.

 

[GTP]

Pretty easy quiz.....

 

[GTP]

You have to take the test as someone moderately knowledgeable with Cyber Security.
The questions are not meant to be analysed. If answered in the context they are presented you should get 10/10.
If you take the test as a Cyber Security "Expert" you'll maybe get 4 right...

 

[GTP]

Test your passwords here.
www.grc.com/haystack.html

 

[NETWizz]

Yeah VPN question does not seem OK. And I got some issue with 2-step auth vs. 2-factor auth, which looks somewhat loosely defined.

This question isn't quite right:


What does the “https://” at the beginning of a URL denote, as opposed to "http://" (without the “s”)?

You correctly answered That information entered into the site is encrypted

Actually the information I received from the site was encrypted at least for the file or page in the URL bar. That said, some elements may be from insecure sources like adding an HTML IMG tag to bring in an image from a regular http site. Additionally, HTML forms generally have a POST and rarely a GET method. When POST is used, it sends the data to a dynamic server-side script like a .pl, .cgi, .php, .asp, .aspx, .jsp or similar. There is NO guarantee that is secure or that it even goes to the same website. Someone could setup a form on a secure site to POST data to http://insecure.tld/someparser.php and it would be sent in clear-text.



Agree completely that there is a difference between two-factor authentication and two-step authentication. Two factor usually uses a token and a password or PIN, can send an email, etc. It is like the Google Authenticaor. Two-step auth is merely having the user recognize a photo, deal with a CAPTCHA or some other process to make logging in take an extra step.


WTh!5Z is the most secure password because it has uppercase, lowercase, symbols, and numbers.


It CAN be safe to do online banking over airport WiFI. If the bank uses a high quality Cipher, hash, and key exchange, and you VERIFY the certificate is not a man-in-the-middle substitution then you have true, private encrypted connectivity to the bank.


They say VPN makes WiFi safe, and it CAN but it doesn't necessarily. What it generally does is tunnel 0.0.0.0/0 over the tunnel, which is encrypted point to point, so you have no clear text on unencrypted WiFi and can safely access unencrypted sites via HTTP. That said, most VPN has taken a trend to deliver a split-tunnel this day and age. If I connect into my work, I have differnet profiles including the all above, but I might just tunnel 10.0.0.0/8 back in providing a split tunnel. In this case the WiFi for the Internet would likely go through the airport's 192.168.0.0/16 or their 172.16.0.0/12 direct and NOT the tunnel.

Hence the people making these don't really always have the best information on the tests.

 

[GTP]

FTFY.

I didn't mean actually enter your own passwords!
Just enter some random gibberish or common words and see how long it takes to "crack" them.
Whenever I change a password I enter it here (after I've changed it, of course).....

"The calculator then puts the resulting large numbers (with lots of digits or large powers of ten) into a real world context of the time that would be required (assuming differing search speeds) to exhaustively search every password up through that length, assuming the use of the chosen alphabet.."


I change my passwords regularly.
This is an example of a typical password I would use. t*@vc3~#0fFh56r&*f%ee$8%^Sxyv~#0G
Some are longer where sites permit up to 63 characters; some (like my bank) will only allow 6 characters of mixed lower case letters and numbers!

 

[Alexey]

What does the “https://” at the beginning of a URL denote, as opposed to "http://" (without the “s”)?

You correctly answered That information entered into the site is encrypted

Actually the information I received from the site was encrypted at least for the file or page in the URL bar. That said, some elements may be from insecure sources like adding an HTML IMG tag to bring in an image from a regular http site. Additionally, HTML forms generally have a POST and rarely a GET method. When POST is used, it sends the data to a dynamic server-side script like a .pl, .cgi, .php, .asp, .aspx, .jsp or similar. There is NO guarantee that is secure or that it even goes to the same website.

Are you sure about that? I thought most browsers will produce a warning, like You are going to send data over unencrypted connection?
And also FireFox tells me sometimes something like Non-secure elements of the page was removed.
I was always thinking that if the form is https:, renders correctly, and raises no warnings, then the data is in fact encrypted and sent to where it should be (unless the other side is compromised), is it not correct?

 

[Moltuae]

You can use cell tower triangulation to work out the location fairly accurately of a mobile, you don’t need GPS.

There's also WiFi proximity. I believe some software (such as Prey, for example) use a WiFi proximity method. If I recall correctly, Google has used this method too, which sparked controversy when their 'Google Street' mapping vehicles were caught collecting data on available WiFi networks. The idea is that, if you have sufficient location data for WiFi access points, you can fairly accurately (especially in densely populated areas) determine the location of a device if you're able to examine which wireless networks are in its vicinity and how strong each of the signals are. To build a detailed WiFi location database in the first place you either need to drive the area, gathering publically available WiFi signal information, which takes a lot of time and effort, or you can simply request that users of your software/apps 'allow access' to their WiFi and GPS devices, to which most will likely consent. If you have millions of users granting you access to WiFi and GPS info, you can very quickly create a map of WiFi hotspot locations.

 

[NETWizz]

Are you sure about that? I thought most browsers will produce a warning, like You are going to send data over unencrypted connection?
And also FireFox tells me sometimes something like Non-secure elements of the page was removed.
I was always thinking that if the form is https:, renders correctly, and raises no warnings, then the data is in fact encrypted and sent to where it should be (unless the other side is compromised), is it not correct?

Most browsers provide the warnings you mentioned, and people click YES

 

[Aranarth]

I also got 9/10 but I thought couple were ambiguous....

 

[cypress]

I got 8/10

 

[CaliZ]

10/10. The questions are worded weird and I agree the password one was a little dumb as the correct answer follows some complexity (Upper case, lower case, number, symbol) but shorter than the other. How many of you are OSCP? I have been learning it more and more even for the review of what *could* be used to test the security of a network/website/etc.

 

[ComputerRepairTech]

9/10, I answered the questions like they were being asked by a moron but I was not prepared for this:


The thing that really surprises me is that if those stats are right then 93% of people don't know what a phishing attack is?

Edit: As I think about this more, its probably because of "spear phishing" which I have heard experts and media refer to malware links from a trusted individual targetting a specific employee or division but I still disagree with the use of phishing in there.

Sending a malware link from something that looks like a trusted source is not phishing its the standard. How many times do you remember getting an email thats from russianhacker at mail dot ru thats like: hey if you click this link it would make me really happy.

 

[Alexey]

The thing that really surprises me is that if those stats are right then 93% of people don't know what a phishing attack is?

That depends on your definition of phishing, and no unviersally agreed-upon definition exists.

 

[mr m]

8/10. I thought I aced it.

 

[ComputerRepairTech]

That depends on your definition of phishing, and no unviersally agreed-upon definition exists.

Well...what if I say phished, if I say im selling 100,000 phished email accounts you think someones going to be like hmm I wonder what he infected those people with? God I hope not xD

Edit: Also if the definition of phishing was to get a user to click on a malicious link or file by impersonating a trusted source then technically wouldnt any rogue update accepted by a user also fall under this category? For example you didnt have ccleaner on auto update but you updated it manually and got that rogue update then wouldnt that fall under this same broad incorrect definition?

then you got those compromised devices like mp3 players, if from a trusted manufacturer and the purchaser runs a malicious program installation thats on the device wouldnt that also be phishing under this definition?

 

[Alexey]

Also if the definition of phishing was to get a user to click on a malicious link or file by impersonating a trusted source then technically wouldnt any rogue update accepted by a user also fall under this category?

Yes. Why shouldn't it?

 

[HCHTech]

Let's beat this dead horse just a little more, shall we?

I got the password question wrong because I valued (gut reaction, not based on research) length over complexity. The quiz has the correct answer as the shorter-but-more-complex choice. In fact, if you look at how password entropy is calculated, this would be incorrect.

NOTE: I appreciate that any posting containing math is virtually certain to contain a typo or other mistake - go ahead, let me have it. haha.

So,where C = size of the character set and L is the password length
The number of entropy bits is L * [log(C) / log(2)]

The two answers to their question we are debating are into*48 and WTh!5Z

The first one, into*48 has only lower case alphas, numbers and symbols. Total character set size = 26 + 10 + 32 = 68

The second one, WTh!5Z has upper case alphas, lower case alphas, numbers and symbols. Total character set size = 26 + 26 + 10 + 32 = 94

Therefore, the entropy bits in into*48 = 7*[log(68) / log(2)] = 7 * (1.83251 / .30103) = 42.61 bits of entropy

The entropy bits in WTh!5Z = 6*[log(94) / log(2)] = 6 * (1.97313 / .30103) = 39.33 bits of entropy

So - HA! into*48 is a stronger password.

It seems clear that length is WAY more important than complexity. Which validates the XKCD cartoon I joked about (not that I would ever challenge Randall Monroe's math!).

 

[Markverhyden]

Password entropy is actually the difficulty in guessing a password. You can calculate the entropy for any particular password like you did @HCHTech. The math is simple, each additional character always give the password more entropy. In reality each password character should, in theory, be any possible character generated on the keyboard, usually 96 unique characters. So a brute force attack has to cover all 96 for each character. But brute force is so 1990's. Most sites these days, with critical info, also limit failed login attempts, locking the account, which makes it moot.

I think the reason they said WTh!5Z is more secure is because "they" said to mix cases is better. That's why I chose it.

 

[Alexey]

The first one, into*48 has only lower case alphas, numbers and symbols. Total character set size = 26 + 10 + 32 = 68

The second one, WTh!5Z has upper case alphas, lower case alphas, numbers and symbols. Total character set size = 26 + 26 + 10 + 32 = 94

There is some assumption hidden in there.
For example, if the requirement is NO LESS THAN lower alpha, numbers, symbols, then both into*48 and WTh!5Z do match the requirement.
And the character space is about 96 (127-31) in all cases, unless some characters are forbidden in password.
You assume that the passwords exactly match minimum variation requirement, and they further assume that you assume it.