ECSS Leak Questions

Mark implemented full memory encryption for the data stored in RAM. This means that the data is encrypted while it is actively being used by the system (e.g., during processing, execution, or manipulation). Data in use refers to the state when data resides in memory and is accessible by running processes. By encrypting data in use, Mark ensures that even if an attacker gains access to the system’s memory, they won’t be able to read sensitive information directly.

References:

• EC-Council Certified Encryption Specialist (E|CES) documents and study guide1.
• EC-Council Certified Encryption Specialist (E|CES) course materials2.

The scenario described is a classic example of SMiShing, a form of social engineering attack that uses text messages (SMS) to deceive individuals into providing sensitive information. In this case, Christian receives an urgent message prompting him to call a phonenumber, which is a tactic used in SMiShing attacks to create a sense of urgency and legitimacy. Upon calling the number, he is asked to provide personal financial information, which is the ultimate goal of the attacker.

SMiShing attacks often impersonate legitimate entities, such as banks, to trick victims into believing that the request is authentic. The use of a recorded message asking for credit or debit card numbers and passwords is a telltale sign of a SMiShing attempt, as legitimate banks would not ask for such sensitive information via a phone call initiated by an unsolicited text message1. Therefore, the correct answer is A, SMiShing, which specifically refers to phishing attacks conducted through SMS.

Certainly! Let’s analyze the Apache error log entry to identify the IP address:

• The IP address from which the request was made is 10.0.0.8 (option A).

This address appears in the log entry as follows:

(client 10.0.0.8] File not found: /images/folder/pic.jpg"

References:

• EC-Council Certified Security Specialist (E|CSS) documents and study guide provide insights into network security and log analysis1.
• Apache error logs follow a specific format, where the client IP address is indicated1.

The net view command in Windows is used to display a list of resources being shared on a computer. When used with a specific computer name or IP address, as in net view <10.10.10.11>, it displays the shared resources available on that particular computer1. Jessy’s objective in running this command was likely to review the file shares on the server with the IP address 10.10.10.11 to ensure that they are correctly purposed and not maliciously altered or added as part of the web attack.

This command does not verify users using open sessions, check file space usage, or check whether sessions have been opened with other systems. Instead, it specifically lists the shared resources, which can include file shares and printer shares, providing insight into what is being shared from the server in question. This information is crucial during a forensic investigation of a web attack to understand if and how the server’s shared resources were compromised or utilized by the attacker.