Register
4:59
Stop
CEH - System Hacking - Vulnerability Exploitation
Expert
1/5
A security researcher is assessing a smart home automation system for vulnerabilities. During scanning, they identify that the system uses an outdated MQTT broker (version 1.5.2) with a known authentication bypass vulnerability (CVE-2021-34432). The vulnerability allows attackers to publish commands to restricted topics that control critical home functions like door locks and security alarms. The client needs proof of concept that demonstrates the impact before approving a firmware upgrade. What is the most appropriate approach to ethically demonstrate this vulnerability?
a.
Exploit the vulnerability in the production environment during off-peak hours when most residents are away, limiting commands to reading topic structures rather than modifying device states
b.
Fully exploit the vulnerability on the production system by sending non-destructive commands to toggle lights on and off, demonstrating complete control while avoiding security features
c.
Create a test environment with the same broker version, exploit the vulnerability there, then use only benign MQTT messages on the production system to prove access to restricted topics
d.
Inform the client that theoretical proof based on CVE documentation should be sufficient, as any actual exploitation could potentially impact home security functions in unexpected ways
Expert