Cloud computing (ODD)
1. Explain the evolution of Cloud computing (10)
2. Explain SaaS, PaaS, IaaS with suitable examples (10)
3. Explain the software engineering principles (10)
4. Draw the system design for Online course management system (10)
5. Case Study
In July 2012, the hacker group, UGNazi, exploited amajor flaw in Google’s gmail password recovery process andAT&T’s voicemail system which in turned allowed the groupto access the CEO of CloudFare’s personal gmail account[13]. The hacker deceived AT&T’S system into redirectingthe victim’s cell phone to a fraudulent voicemail box. Thehacker visited gmail and initiated the account recovery featurefor the victim’s personal email address. A voicemail messagewas recorded on the compromised voicemail box to soundlike someone was answering the phone. A call was placed tothe victim from Google, but the victim did not recognize thenumber and let the call go to voicemail. Google’s system wastricked by the fraudulent voicemail and a temporary PIN wasleft (which allowed the password to be reset) in the voicemail.
The hacker logged into the victim’s gmail account and addedhis email address to the ‘account recovery control’ feature.The victim’s linked Cloudfare account received an emailinforming him that the recent password was changed. Thevictim initiated the account recovery process and changed thepassword back. An email is sent to the hacker informing himthat the victim changed passwords, but immediately thehacker changed the password. Both users continue going backand forth to get control over the account. Soon, the hacker isable to remove the victim’s mobile phone and email addressesauthorized for account recovery preventing the victim fromresetting the gmail password. The team at CloudFare is calledto investigate the situation
Question
1. How to design the webapp to safeguard from hacking
2. Why security is important for webapp
Cloud computing (Even)
1. Draw and explain the architecture of Cloud
2. How the online budgeting application can be accomplished?
3. How to manage the web based projects?
4. Draw the system design for CRM System
5. Case Study
In a malware-injection attack an adversary attempts to inject malicious code into a system. This attack can appear in the form of code, scripts, active content, and/or other software. When an instance of a legitimate user is ready to run in the cloud server, the respective service accepts the instance for computation in the cloud. The only checking done is to determine if the instance matches a legitimate existing service. However, the integrity of the instance is not checked. By penetrating the instance and duplicating it as if it is a valid service, the malware activity succeeds in the cloud.
Case one occurred in May 2009. The United States Treasury Department moved four public websites offline for the Bureau of Engraving and Printing after discovering malicious code was added to the parent side. The thirdparty cloud service provider hosting the company’s website was victim to an intrusion attack. As a result numerous websites were affected. Roger Thompson, chief research officer for Anti-Virus Guard (AVG) Technologies, discovered malicious code was injected into the affected pages. Hackers added a tiny snippet of a virtually undetectable iFrame HTML code that redirected visitors to a Ukrainian website. IFrame (Inline Frame) is an HTML document embedded inside another HTML document on a website. From there, a variety of web-based attacks were launched using an easy-to-purchase malicious toolkit called the Eleonore Exploit Pack.
Questions:
1. What is malware? What are the impacts of malware?
2. Explain IFrame.
1. Explain the evolution of Cloud computing (10)
2. Explain SaaS, PaaS, IaaS with suitable examples (10)
3. Explain the software engineering principles (10)
4. Draw the system design for Online course management system (10)
5. Case Study
In July 2012, the hacker group, UGNazi, exploited amajor flaw in Google’s gmail password recovery process andAT&T’s voicemail system which in turned allowed the groupto access the CEO of CloudFare’s personal gmail account[13]. The hacker deceived AT&T’S system into redirectingthe victim’s cell phone to a fraudulent voicemail box. Thehacker visited gmail and initiated the account recovery featurefor the victim’s personal email address. A voicemail messagewas recorded on the compromised voicemail box to soundlike someone was answering the phone. A call was placed tothe victim from Google, but the victim did not recognize thenumber and let the call go to voicemail. Google’s system wastricked by the fraudulent voicemail and a temporary PIN wasleft (which allowed the password to be reset) in the voicemail.
The hacker logged into the victim’s gmail account and addedhis email address to the ‘account recovery control’ feature.The victim’s linked Cloudfare account received an emailinforming him that the recent password was changed. Thevictim initiated the account recovery process and changed thepassword back. An email is sent to the hacker informing himthat the victim changed passwords, but immediately thehacker changed the password. Both users continue going backand forth to get control over the account. Soon, the hacker isable to remove the victim’s mobile phone and email addressesauthorized for account recovery preventing the victim fromresetting the gmail password. The team at CloudFare is calledto investigate the situation
Question
1. How to design the webapp to safeguard from hacking
2. Why security is important for webapp
Cloud computing (Even)
1. Draw and explain the architecture of Cloud
2. How the online budgeting application can be accomplished?
3. How to manage the web based projects?
4. Draw the system design for CRM System
5. Case Study
In a malware-injection attack an adversary attempts to inject malicious code into a system. This attack can appear in the form of code, scripts, active content, and/or other software. When an instance of a legitimate user is ready to run in the cloud server, the respective service accepts the instance for computation in the cloud. The only checking done is to determine if the instance matches a legitimate existing service. However, the integrity of the instance is not checked. By penetrating the instance and duplicating it as if it is a valid service, the malware activity succeeds in the cloud.
Case one occurred in May 2009. The United States Treasury Department moved four public websites offline for the Bureau of Engraving and Printing after discovering malicious code was added to the parent side. The thirdparty cloud service provider hosting the company’s website was victim to an intrusion attack. As a result numerous websites were affected. Roger Thompson, chief research officer for Anti-Virus Guard (AVG) Technologies, discovered malicious code was injected into the affected pages. Hackers added a tiny snippet of a virtually undetectable iFrame HTML code that redirected visitors to a Ukrainian website. IFrame (Inline Frame) is an HTML document embedded inside another HTML document on a website. From there, a variety of web-based attacks were launched using an easy-to-purchase malicious toolkit called the Eleonore Exploit Pack.
Questions:
1. What is malware? What are the impacts of malware?
2. Explain IFrame.
