Questions & explanations
1. Give a step-by-step example of a threat hunt for lateral movement using a common technique.
Hypothesis: An attacker is using RDP (Remote Desktop Protocol) to move laterally across the network. Step 1: Collect Windows security logs (Event ID 4624 for logons) from all domain controllers and servers. Step 2: Look for many RDP logons from a single workstation to multiple servers within a short time. Step 3: Filter for logon type 10 (RemoteInteractive) and successful logons. Step 4: Check if the source workstation has been flagged as suspicious earlier (like atypical user). Step 5: Also look for RDP logons over non-standard ports or using unusual account names, like 'admin'. Step 6: If found, query endpoint detection tools for other activity on the source machine. Step 7: Escalate to incident response for containment and analysis.
2. Compare front-running in blockchain to front-running in traditional finance.
In traditional finance, front-running is illegal. It involves a broker trading stocks based on private knowledge of a client's upcoming large order. The broker profits because the order will move the price. In blockchain, front-running is often not illegal but considered unfair. It happens because all pending transactions are visible to everyone. In traditional markets, speed and private information matter, but blockchains add the mempool transparency. Both types exploit order timing, but blockchain front-running is easier to automate with bots. Unlike traditional finance, there is no central authority to stop it, so users must use other methods like private transactions to protect themselves.
3. What mechanism does Casper FFG use to achieve finality and prevent reorgs in Ethereum 2.0?
Casper FFG (Friendly Finality Gadget) is a mechanism that adds finality to the Proof-of-Stake chain. Validators vote on checkpoints, which are blocks every 32 slots. If two-thirds of the validators vote for the same pair of checkpoints, those checkpoints become finalized and cannot be reversed. Finality happens after two rounds of voting: first a checkpoint is justified, then after another round it is finalized. Once finalized, a block is permanent, even if an attacker has more stake. This prevents deep reorgs because the finalized blocks are protected by the weight of validator votes. Casper FFG combines with the longest-chain rule to give both fast confirmation and irreversible finality.
4. Compare microsegmentation with traditional perimeter-based security.
Traditional perimeter security places a firewall at the network edge to protect the entire internal network. Once inside, an attacker can move freely between servers. Microsegmentation instead creates many small perimeters inside the network around each workload. This makes it much harder for an attacker to move laterally. Traditional security trusts everything inside the network, while microsegmentation applies zero-trust by requiring verification for every connection. Microsegmentation also allows more granular control, such as blocking specific traffic between two application tiers. The downside is that microsegmentation is more complex to set up and manage than a single firewall.
5. Give an example of a vulnerability that static analysis can detect.
One common vulnerability is reentrancy, where a function makes an external call before updating its own state. For example, a withdraw function sends ether to a user and then decreases their balance. An attacker can call the withdraw function again before the balance is updated, draining the contract. Static analysis tools can detect this by checking if external calls happen before state changes. Another example is integer overflow, where arithmetic operations exceed the maximum value. Tools look for unchecked arithmetic that could let an attacker manipulate balances. They also find missing access controls, like functions that should only be callable by the owner but are public.
6. How does Windows NTFS permission differ from Unix file permissions?
NTFS permissions are more detailed than Unix basic permissions. While Unix has only read, write, and execute for three groups, NTFS has many specific rights like 'Modify', 'Read & Execute', 'List Folder Contents', 'Write', and 'Read'. NTFS also supports inheritance, where a folder's permissions automatically apply to its child files and subfolders. Unix permissions do not inherit by default; each file has its own set. Additionally, NTFS uses Access Control Lists (ACLs) that can list many individual users or groups. Unix also supports ACLs, but they are an extension to the basic three-group model. Windows also integrates with Active Directory for centralized management.
7. How can you implement row-level security in a database?
Row-level security restricts which rows a user can see or modify. In SQL databases like PostgreSQL or SQL Server, you can create security policies that add filters based on user attributes. For example, you can define a policy that only shows rows where 'department = current_user_department'. This is done using a function that returns the predicate. In Oracle, you use Virtual Private Database (VPD) with a policy function. Row-level security ensures that users see only their own data even if they query the whole table. It is an extension of column-level security. NoSQL databases like MongoDB have field-level redaction but not built-in row-level filtering as easily.
8. How does a tool like Slither find vulnerabilities?
Slither takes the smart contract source code or bytecode and converts it into an intermediate representation. It then runs a set of analysis passes, each designed to detect a specific vulnerability type. For instance, it checks if a function can be called by anyone when it should be restricted. It also looks for patterns like using tx.origin for authentication, which is unsafe. Slither traces how data flows through the contract to see if critical variables can be changed unexpectedly. The tool outputs a list of findings with severity levels and suggestions for fixing. Developers can integrate Slither into their development pipeline to catch bugs before deployment.
9. Give an example of how APAC regulations might require a company to report a data breach differently than under GDPR.
Under GDPR, a company must report a breach to the supervisory authority within 72 hours if it risks individuals' rights. In India, the DPDP Act requires reporting a breach to the Data Protection Board as soon as possible, but timelines are still being finalized. China's PIPL demands immediate notification to affected individuals and regulators. Additionally, some APAC countries like South Korea require reporting even small breaches. For example, a breach in Japan under the APPI (Act on Protection of Personal Information) must be reported only if it involves sensitive data. So a company may need to prepare multiple notification templates for different regulators.
10. What is one strategy to reduce MEV, such as using a private mempool?
One strategy is to use a private mempool, where transactions are not broadcast publicly until they are included in a block. For example, Flashbots provides a service that lets users send transactions directly to miners without going through the public mempool. This prevents front-running bots from seeing the transaction. Another method is to use commit-reveal schemes, where users first commit to a transaction hash and later reveal the details. Some blockchains design protocols that randomize transaction order or enforce fairness. However, private mempools can centralize power if only some miners have access. Overall, MEV reduction is an active area of research.
11. Why do governments sometimes release open data despite privacy risks?
Governments release open data to increase transparency, allow citizens to hold them accountable, and help researchers and businesses create useful tools. For example, open data on crime can help people choose safe neighborhoods, and open data on government spending helps fight corruption. However, they must balance these benefits with the need to protect individual privacy. They use techniques like removing direct identifiers, aggregating data, and applying privacy-preserving methods like differential privacy. Releasing open data is a trade-off: the public good often outweighs the small risk of re-identification, but they constantly work to reduce that risk.
12. Why is static analysis not enough to guarantee a contract is secure?
Static analysis checks only the code structure, not the runtime behavior or interactions with other contracts. It cannot detect logical errors that follow the rules but still cause harm, like an auction that always sells to the last bidder instead of the highest. It also may miss issues that depend on external data, such as oracle manipulation. False positives can waste time, but false negatives mean real bugs go unseen. Some vulnerabilities only appear when the contract is used in a specific way, like with particular input values. Therefore, auditors combine static analysis with manual review, dynamic testing, and formal verification to increase confidence.