Question 1. Answer the following multiple choice questions (one or more correct answers). (1 point * 13) 1. Which of the following types of locations in a process address space that buffer overflow attacks typically target? a) Stack b) Heap c) Code 2. Which of the following are common defenses against stack buffer overflow? a) Address Space Layout Randomization (ASLR) b) DEP/Non-executable stack c) Control-Flow Integrity (CFI) 3. Which programming languages are vulnerable to stack buffer overflow? a) C b) Java c) Assembly 4. How can a stack buffer overflow hijack the control flow of the program? a) Overwriting the return address on the stack b) Overwriting a function pointer on the stack c) Overwriting the saved stack frame pointer (saved EBP) 5) With DEP defense enabled, which of the following becomes impossible? a) Overwriting the return address on the stack b) Injecting shellcode onto the stack and execute it by jumping to it c) Finding a useful gadget to jump to in Return-Oriented Programming (ROP) 6) In the ROP attack, which register now plays the role similar to that of instruction pointer (EIP)? a) EAX b) ESP C) EBP 7) Which defenses have been (partially) deployed in modern operating systems? a) Access control list b) ASLR c) Control-Flow Integrity (CFI) 8) Which are the reasons why blind ROP attack against a web server works despite the fact that all modern defenses are deployed? a) Web server forks a child process with the same address space layout every time to serve a new connection b) Stack canary value stays the same even if a guess is wrong c) The version of enabled ASLR does not provide sufficient randomness 9) How does the blind ROP attack determine if a code sequence contains the desired gadget (since it's blind)? a) It learns the address of the gadget by obtaining a copy of the binary beforehand b) It sets up the stack in special ways so that the detected gadget will be uniquely identifiable c) It leverages the feedback about whether a server has crashed or not 10) Which of the following of x86 architecture makes overlapping instructions possible (ie, one can jump to the middle of an instruction and the CPU can recognize it as a different valid instruction? yet a) Instruction lengths are not multiples of 8 bits b) Instructions have variable length c) Most byte sequences are legal instructions 11) What are some examples that conceptually map to the BLP or Biba model? a) in buffer overflow, command line argument is considered a low-integrity object. A root process is considered a high-integrity subject that should not be allowed to read the low. integrity data (thus allowing control flow to be hijacked) b) In time-of-check, time-of-use attack, the file or directory controlled by an attacker is considered a low-integrity object. A root process is considered a high integrity subject that should not be allowed to read the low-integrity data (thus being tricked to perform unintended operations) c) in directory traversal attack, the passwd file is considered the high-secrecy object. A root process (web server) is considered a low-secrecy subject since it needs to read the public HTML files and serve them to clients. A low-secrecy subject should not be allowed to read a high-secrecy object (thus leaking the passwd file unintendedly) 12) Which of the following about resource access attacks are correct? a) They are caused by mismatches of expectations (e.g., high-integrity subjects expect high- integrity objects but mistakenly got low-integrity objects). b) We need to look at both the code and access control policy to identify resource access attacks c) They are caused by violations of BLP or Biba security policies. 13) in computer security, there's a well-known principle called principle of the least privilege. The idea is that every subject (process, user, program) should have access to only the information and resources they absolutely need (no more should be allowed). Which of the following are correct based on your judgement? a) Not running processes as root when not necessary (e.g., chrome or firefox) is a one example of principle of least privilege b) The reasoning behind the principle is to prevent an attacker to compromise a subject c) The reasoning behind the principle is to reduce the damage once a subject is compromised

RSQ5VT The Asker · Computer Science