When Alice initiates communication with the website foo.com, foo.com sends Alice the site’s certificate. Which of the following statements is true about this certificate? The certificate includes foo.com’s private key, signed by the CA’s public key. The certificate includes foo.com’s public key, signed by the Alice’s private key. The certificate include’s foo.com’s public key, signed by the CA’s private key. The certificate includes foo.com’s public key, signed by foo.com’s private key. 8) Suppose the private key for http://www.goldieswebstore.com has been compromised. Suppose the webmaster reissues the certificate but does not revoke the compromised one. Describe a feasible attack that the person who compromised the private key could carry out. 6) Suppose the website https://identityprovider.utulsa.edu sets a login cookie called auth-user with domain = .utulsa.edu and path = / after a user successfully logs into the system. Suppose that https://hacked.utulsa.edu falls under the control of the attacker. Can an attacker controlling https://hacked.utulsa.edu obtain the auth-user cookie in order to impersonate the user? If YES, explain how. If NO, explain why not. Can an attacker controlling https://hacked.utulsa.edu overwrite the auth-user cookie? Answer YES or NO. Referring to Question 5, why or why not? Here is the question 5 for referring but not need to answer for below question: For Questions 3-5, suppose the following cookies, each named cid, have been set. C1: value = a2, domain = x.y.com, path = /, non-secure C2: value = b5, domain = .y.com, path = /, secure C3: value = b8, domain = .y.com, path = /foo/, non-secure 5) Suppose an attacker has taken control of http://hackedserver.y.com. List each of the cookies C1, C2, C3 that the attacker can overwrite with value = evildoer.
7) When Alice initiates communication with the website foo.com, foo.com sends Alice the site’s certificate. Which of the following statements is true about this certificate?
- The certificate includes foo.com’s private key, signed by the CA’s public key.
- The certificate includes foo.com’s public key, signed by the Alice’s private key.
- The certificate include’s foo.com’s public key, signed by the CA’s private key.
- The certificate includes foo.com’s public key, signed by foo.com’s private key.
8) Suppose the private key for http://www.goldieswebstore.com has been compromised.
Suppose the webmaster reissues the certificate but does not revoke the compromised one. Describe a feasible attack that the person who compromised the private key could carry out.
6) Suppose the website https://identityprovider.utulsa.edu sets a login cookie called auth-user with domain = .utulsa.edu and path = / after a user successfully logs into the system.
- Suppose that https://hacked.utulsa.edu falls under the control of the attacker. Can an attacker controlling https://hacked.utulsa.edu obtain the auth-user cookie in order to impersonate the user? If YES, explain how. If NO, explain why not.
- Can an attacker controlling https://hacked.utulsa.edu overwrite the auth-user cookie? Answer YES or NO. Referring to Question 5, why or why not?
Here is the question 5 for referring but not need to answer for below question:
For Questions 3-5, suppose the following cookies, each named cid, have been set.
C1: value = a2, domain = x.y.com, path = /, non-secure
C2: value = b5, domain = .y.com, path = /, secure
C3: value = b8, domain = .y.com, path = /foo/, non-secure
5) Suppose an attacker has taken control of http://hackedserver.y.com. List each of the cookies C1, C2, C3 that the attacker can overwrite with value = evildoer.
-
The certificate includes foo.com’s public key, signed by the CA’s private key.
-
If the webmaster reissues the certificate but does not revoke the compromised one, the attacker who compromised the private key could carry out a man-in-the-middle (MITM) attack. The attacker could intercept and read any data exchanged between the server and clients, including sensitive information such as passwords, credit card numbers, and personal data. The attacker could also impersonate the server and send fake responses to clients.
Trending now
This is a popular solution!
Step by step
Solved in 2 steps
