ITPEC IP October 2020 Question 44
An IoT device with a vulnerability was used in large numbers by several companies. One (1) of the devices was infected with malware, and the infection spreads to many other IoT devices. On a certain date at a certain time, the many IoT devices that were infected with the malware attempted many connections to a certain website simultaneously, and this forced the service of the website to stop. Which of the following attacks was made against the website?
Explanation
DDoS attack — many infected devices flooding one website with connections at the same moment until its service stops.
The malware that spread from device to device turns the vulnerable IoT devices into a botnet: bots that wait for the attacker's command. At the chosen date and time the attacker orders all of them to connect to the target website; its bandwidth, connections and processing are exhausted, and legitimate users can no longer be served. The attack destroys availability.
It is distributed because the traffic comes from thousands of different sources, so blocking a single IP address, which stops an ordinary DoS attack, does not help.
Answer (a)
Why not others:
- •(b) Cross-site scripting — injects a script into a vulnerable website so that it runs in visitors' browsers, for example to steal cookies; it does not stop the site
- •(c) Dictionary attack — tries the words of a list as passwords to log in to an account
- •(d) Social engineering — tricks people, for example by phone or by looking over a shoulder, into giving away passwords or other information
Key rule: IoT devices left with default passwords or unpatched firmware are recruited into botnets; changing the password and updating the device keeps it from becoming one of the attackers.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.