CYBER 366 Exam1 Questions and
Answers
Hash functions produce a fixed-length output - Answer-usually, 128 bits-form a message of any length.
Hashes are unique to the input (message) that produces them.
Alerting just one bit of the input (message) will produce a noticeably different hash output.
There is no way of recovering the original input (message) form the output hash value. The hash
function is a one way function.
One-way function is a function that is easy to compute output in one direction, but it is very difficult to
compute the input data from the output.
There are many hashing algorithm such as - Answer-MD2, MD4, MD5, and Secure Hash Algorithm
(SHA).
MD2 produces a hash value (message digest) of 128 bits long. It is secure but very slow algorithm.
MD4 is faster than MD2 and simple to use. It uses three processing rounds to produce a hash of 128 bits
long. However it was subject to successful attacks
MD5 was developed from MD4 and to be more secure than MD4. It uses four processing rounds to
produce a hash of 128 bits long.
MD5 hashing algorithm is used frequently on routers, servers, and computers
MD5is susceptible to collision attacks and broken
,The most secure hashing algorithm is the - Answer-SHA (Secure Hash Algorithm).
SHA was developed by U.S. National Security Agency as NIST ( National Institute Standard and
Technology) standard.
SHA-1 produces a hash value (message digest) of 160 bits by four processing rounds.
SHA-1 is employed in several widely used security applications and protocols, including TLS and SSL,
PGP, SSH, S/MIME, and IPsec.
SHA-1 was cracked in 2007 by Professor XiaoyunWangand her associates in Tsinghua University and
Shandong University of Technology
Several vendors (Microsoft, Google, etc.) try to move from SHA-1 to SHA-2 (selected in 2012)
SHA-2:has three versions: SHA-256, SHA-384, and SHA-512 algorithms
Applications of Hash Function - Answer-Malware identifier (Run a hashing function (e.g. MD5) against
the malware code in order to get the malware hash (fingerprint) that identifies the malware)
Virus scan software (You should update the virus database regularly to include the hash values of new
viruses)
Protect password information
Software Authenticity
Data integrity for stored files
Provide data integrity for public encryption
Keyed hash for message authentication
Digital signatures
Before you can run malware to perform dynamic analysis, you must set up a safe environment. -
Answer-A safe environment will allow you to investigate the malware without exposing your machine or
other machines on the network to unexpected and unnecessary risk.
Environment for analyzing Malware - Answer-Automated solutions (sandboxes)
, Controlled environment
Virtual Machines
A sandbox is an - Answer-isolated testing environment that enables users to run programs or execute
files without affecting the application, system or platform on which they run.
Controlled Environment - Answer-Malware can be analyzed using individual physical machines on
isolated networks (called air-gapped networks) that are disconnected from the Internet or any other
networks to prevent the malware from spreading.
Air-gapped networks allow you to run malware in a real environment without putting other computers
at risk.
Disadvantage of this test scenario,
1. Lack of an Internet connection. Many pieces of malware depend on a live Internet connection for
updates, command and control, and other features.
2-Analyzing malware on physical rather than virtual machines can be difficult to remove.
The main advantage to using physical machines for malware analysis is that malware can sometimes
execute differently on virtual machines.
Some malware can detect that it's being run in a virtual machine, and it will behave differently to thwart
analysis.
Virtual Machine Testing Environment - Answer-Because of the risks and disadvantages that come with
using physical machines to analyze malware, virtual machines are most used for dynamic analysis.
A virtual machine (guest OS) is installed within a host machine (host OS)
The OS running in the virtual machine is kept isolated from the host OS.
Therefore, malware running on a virtual machine cannot harm the host OS.
If malware damages the virtual machine, reinstall the OS in the virtual machine or return the virtual
machine to a clean state.
Answers
Hash functions produce a fixed-length output - Answer-usually, 128 bits-form a message of any length.
Hashes are unique to the input (message) that produces them.
Alerting just one bit of the input (message) will produce a noticeably different hash output.
There is no way of recovering the original input (message) form the output hash value. The hash
function is a one way function.
One-way function is a function that is easy to compute output in one direction, but it is very difficult to
compute the input data from the output.
There are many hashing algorithm such as - Answer-MD2, MD4, MD5, and Secure Hash Algorithm
(SHA).
MD2 produces a hash value (message digest) of 128 bits long. It is secure but very slow algorithm.
MD4 is faster than MD2 and simple to use. It uses three processing rounds to produce a hash of 128 bits
long. However it was subject to successful attacks
MD5 was developed from MD4 and to be more secure than MD4. It uses four processing rounds to
produce a hash of 128 bits long.
MD5 hashing algorithm is used frequently on routers, servers, and computers
MD5is susceptible to collision attacks and broken
,The most secure hashing algorithm is the - Answer-SHA (Secure Hash Algorithm).
SHA was developed by U.S. National Security Agency as NIST ( National Institute Standard and
Technology) standard.
SHA-1 produces a hash value (message digest) of 160 bits by four processing rounds.
SHA-1 is employed in several widely used security applications and protocols, including TLS and SSL,
PGP, SSH, S/MIME, and IPsec.
SHA-1 was cracked in 2007 by Professor XiaoyunWangand her associates in Tsinghua University and
Shandong University of Technology
Several vendors (Microsoft, Google, etc.) try to move from SHA-1 to SHA-2 (selected in 2012)
SHA-2:has three versions: SHA-256, SHA-384, and SHA-512 algorithms
Applications of Hash Function - Answer-Malware identifier (Run a hashing function (e.g. MD5) against
the malware code in order to get the malware hash (fingerprint) that identifies the malware)
Virus scan software (You should update the virus database regularly to include the hash values of new
viruses)
Protect password information
Software Authenticity
Data integrity for stored files
Provide data integrity for public encryption
Keyed hash for message authentication
Digital signatures
Before you can run malware to perform dynamic analysis, you must set up a safe environment. -
Answer-A safe environment will allow you to investigate the malware without exposing your machine or
other machines on the network to unexpected and unnecessary risk.
Environment for analyzing Malware - Answer-Automated solutions (sandboxes)
, Controlled environment
Virtual Machines
A sandbox is an - Answer-isolated testing environment that enables users to run programs or execute
files without affecting the application, system or platform on which they run.
Controlled Environment - Answer-Malware can be analyzed using individual physical machines on
isolated networks (called air-gapped networks) that are disconnected from the Internet or any other
networks to prevent the malware from spreading.
Air-gapped networks allow you to run malware in a real environment without putting other computers
at risk.
Disadvantage of this test scenario,
1. Lack of an Internet connection. Many pieces of malware depend on a live Internet connection for
updates, command and control, and other features.
2-Analyzing malware on physical rather than virtual machines can be difficult to remove.
The main advantage to using physical machines for malware analysis is that malware can sometimes
execute differently on virtual machines.
Some malware can detect that it's being run in a virtual machine, and it will behave differently to thwart
analysis.
Virtual Machine Testing Environment - Answer-Because of the risks and disadvantages that come with
using physical machines to analyze malware, virtual machines are most used for dynamic analysis.
A virtual machine (guest OS) is installed within a host machine (host OS)
The OS running in the virtual machine is kept isolated from the host OS.
Therefore, malware running on a virtual machine cannot harm the host OS.
If malware damages the virtual machine, reinstall the OS in the virtual machine or return the virtual
machine to a clean state.
