Chapter 09: Embedded Operating Systems: The Hidden Threat

Amount of code a computer system exposes to unauthenticated outsiders

Attack surface

What type of malicious code could be installed in a system's flash memory to allow an attacker to access the system at a later date? patch BIOS-based rootkit unclassified kernel embedded browser

BIOS-based rootkit

What programming languages are vulnerable to buffer overflow attacks? C and Python Assembly and C++ C and C++ Perl and Python

C and C++

A standardized protocol that replaced SMB in Windows 2000 Server and later

Common internet file system

A small program developed specifically for use with embedded systems

Embedded operating system

Any computer system that is not a general-purpose PC or server

Embedded system

Software residing on a chip

Firmware

What type of viruses and code has been created by security researchers and attackers that could infect phones running Google's Android, Windows Mobile, and the Apple iPhone OS? Python Java-based C++ Perl

Java-based

Which of the following is a common Linux rootkit? Linux Rootkit 5 Packet Storm Security Kill Trojans Back Orifice

Linux Rootkit 5

A device that performs more than one function, such as printing and faxing is called which of the following? MFD MILS ASA RTOS

MFD

Which of the following is an SELinux OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users? Mandatory Control Mandatory Access Control SE Access Control Access Control

Mandatory Access Control

An OS security mechanism that enforces access rules based on privileges for interactions between processes, files, and users

Mandatory access control

Devices on an organization's network performing more than one function, such as printers, scanners, and copiers

Multifunction devices

An embedded OS certified to run multiple levels of classification on the same CPU without leakage between levels

Multiple independent levels of security

What is the current file system that Windows utilizes that has strong security features? NTFS FAT32 ADS FAT

NTFS

A fast and efficient protocol that requires little configuration and allows transmitting NetBIOS packets over TCP/IP

NetBEUI

An open-source embedded OS used in space systems because it supports processors designed specifically to operate in space

RTEMS

An OS microkernel extension developed for Linux

RTLinux

A specialized embedded OS used in devices such as programmable thermostats, appliance controls, and even spacecraft

RTOS (real time operating system)

An interprocess communication mechanism that allows a program running on one host to run code on a remote host

Remote procedure call

Which of the following systems should be used when equipment monitoring and automation is critical? GUI VoIP CAD SCADA

SCADA

Systems used for equipment monitoring in large industries, such as public works and utilities, power generators and dams

SCADA (Supervisory control and data acquisition)

An open-source implementation of CIFS

Samba

Used to share files and usually runs on top of NetBIOS, NetBEUI, or TCP/IP

Server message block

When using the Common Internet File System (CIFS), which security model does not require a password to be set for the file share? CIF level security Share-level security NT level security User-level security

Share-level security

In 2007 became Windows new standard to deploy and manage servers alongside updated patch-management functionality

System center configuration

Microsoft's standard for managing Windows security patches on multiple computers in a network between 1994 and 2005

Systems management server

Embedded OSs are usually designed to be small and efficient so they do not have some of the functions that general-purpose OSs have. True False

True

A cryptographic firmware boot-check processor installed on many new computer systems

Trusted platform module

When using the Common Internet File System (CIFS), which security model will require network users to have a user name and password to access a specific resource? NT level security User-level security Share-level security CIF level security

User-level security

Which of the following if often found within an embedded OS that can cause a potential vulnerability to an attack? USB port PCB Web server RAM

Web server

Which of the following source code is now available to the public and was considered a trimmed down version of the Windows desktop OS? Windows CE Windows Embedded 8 VxWorks Windows 10 IoT

Windows CE

A Windows client/server technology introduced in 2005 used to manage patching and updating system software from the network

Windows software update service

SCADA systems controlling critical infrastructure are usually completely separated from the Internet by which of the following? air gap firewall router Vlan

air gap

Ubuntu and Debian Linux use what command to update and manage their RPM packages? apt-get dir get yum

apt-get

Rootkits that pose the biggest threat to any OS are those that infect what part of the targeted device? middleware fireware testware firmware

firmware

What is the most serious shortcoming of Microsoft's original File Allocation Table (FAT) file system? no ACL support no Linux support no SUS support no SMTP support

no ACL support

Which of the following is considered to be the most critical SQL vulnerability? SQL password null SA hash SQL scanning null SA password

null SA password

Which one of the following, if compromised might allow attackers the ability to gain complete access to network resources? driver host router rootkit

router