Computer Security. Refer to the attachment for the question.

References is APA

Planet of the Grapes, a local wine and spirit merchantcurrently operates in three stores around Perth. Stores are independent fromone another and there is no data sharing between stores, although this is notby design but simply a by-product of faster than expected expansion. Theorganisation is now moving into the online arena and has contracted yourcomputer consulting company to perform a variety of audits on their computernetwork. The owners have never employed any IT security staff in the past andhave preferred to set up systems for themselves. However, it has becomeapparent that the risks of moving business systems online are not to beignored. For this reason you are being asked to investigate the security of thesystem and make recommendations.

There are two distinct tasks being requested in thisphase of the audit. Each of these should be answered separately.

Question 2:Legacy code (40 marks)

The Internet in Perth is notoriously bad and theInternet connection between Planet of the Grapes and their bank is down on aregular basis. To avoid losing out on any purchases during outages, Planet ofthe Grapes intends to allow offline purchases (as in the good old times).However, credit card data entered by a customer still needs to be verifiedoffline to prevent malicious users from trying to buy goods with fake creditcard numbers.

Planet of the Grapes staff have acquired anapplication that can do this, but they suspect that this program (supposedlyimplemented in C) is vulnerable to a critical and very common type of softwaresecurity vulnerability. Planet of the Grapes has supplied you with a copy ofthe program (part ofhttp://www.it.murdoch.edu.au/szander/ICT287/assignment1/form.php.) When youinquire about this software you learn that it cannot be patched as the code ispart of a suite of utilities supplied by the financial provider and Planet ofthe Grapes cannot get access to the code.

Name and explain the type of vulnerability. Discusswhat types of systems it affects and why it happens (what is the issue?).Discuss the impact of the vulnerability and how it may be exploitedtheoretically.

Besides discussing how the vulnerability may beexploited in general, discuss the impact of the vulnerability in this specificcase of the credit card validation tool and describe and demonstrate (e.g.screenshot) how it can be exploited. It is not required to use a disassemblerfor this task, simply manipulating the tool’s input directly is sufficient.

Given that it is not possible to patch the codedirectly, there is no vendor update and it must remain in use, make at least 3different recommendations that would reduce the risk this application poses.The recommendation must be specific to this case and not general mitigationstrategies that do not apply in this case.

These description of the vulnerability and therecommendations should be presented in a format suitable for a generaltechnical audience – i.e. someone who is proficient in IT in general, but maynot be a security expert. Citations should be used where appropriate.

The expected answer length is approximately 2-3 pagesand the answer must not be longer 4 pages.