Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Computer and Network Security > Application and OS Security > Flashcards

Application and OS Security Flashcards

1
Q

What is the main function of an OS from a bottom up view?

A

A collection of computer programs that manage the computer’s resources, such as the CPU , memory, disk drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the main function of an OS from a top-down review?

A

A collection of computer programs that provide an interface between a user and the hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does each device have connected to the bus?

A

a device controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does a device driver do?

A
  • communicates with the device controller

- enables data to be transferred between buffer and main memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What must a CPU be able to do?

A
  • distinguish between OS and application programs

- prevent application programs from executing privileged instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When is a bootstrap program loaded?

A

at power up or reboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a bootstrap?

A

a technique of loading a program into a computer by means of a few initial instructions which enable the introduction of the rest of the program from an input device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is firmware?

A

a combination of a hardware device and computer instructions or computer data that reside as read-only software on the hardware device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does BIOS mean?

A

Basic Input/output System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the primary role of the BIOS?

A

to initialise and test hardware components and load the OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What could malicious BIOS modification lead to?

A
  • a permanent denial of service

- a persistent malware presence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 5 steps of booting?

A
  1. execute BIOS boot block
  2. initialise and test low-level hardware
  3. load additional firmware modules
  4. select boot device
  5. use boot loader to load OS and run it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what does UEFI stand for?

A

Unified Extensible Firmware Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do UEFI specs define?

A

interface between OS and firmware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are 3 ways the bootloaders can be attacked?

A
  • user-initiated installation of new BIOS code (most difficult to address)
  • malware could re-flash the system BIOS
  • network-based system management tools could cause an organisation-wide BIOS update attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is SMM?

A

System Management Mode - an operating mode of x86 CPU

17
Q

What rootkits are in ring 3?

A

Usermode rootkits

18
Q

What rootkits are in ring 0?

A

Kernelmode rootkits

19
Q

What rootkits are in ring -1?

A

Hypervisor rootkits (bluepill)

20
Q

What rootkits are in ring -2?

A

SMM rootkits

21
Q

What does TPM stand for?

A

Trusted platform module

22
Q

What is a TPM designed for?

A
  • a chip with low cost
  • embedded in a computing platform
  • TPM is an international standard for a secure cryptoprocessor
23
Q

What is a cryptoprocessor?

A

a dedicated microcontroller designed to secure hardware through integrated cryptographic keys

24
Q

What does the TPM provide?

A
  • a random number generator
  • facilities for the generation of cryptographic keys
  • remote attestation to create a nearly unforgeable hash key summary of the hardware and software configuration
  • binding: encrypts data using the TPM bind key
  • sealing: specifies the TPM state for the data to be decrypted
25
Q

What types of TPM are there?

A
  • Discrete
  • Integrated
  • Firmware
  • Software
  • Virtual
26
Q

What are the 2 main application attacks?

A

“user provided input” and “interactions with other systems”

27
Q

What is a symlink attack?

A

attacker creates symlink to file accessible only to the superuser

28
Q

What are command line attacks?

A

directory traversal in path names, command injection attacks, buffer overflows

29
Q

what assumption do buffer overflow attacks make?

A

inputs will be smaller than a certain size and the buffer is created to be that size.

30
Q

What is the problem with buffer overflow attacks?

A

detectability

31
Q

What happens in a remote attack?

A

the attacker manipulates the behaviour of applications over a network connection

32
Q

What is the goal of a remote attack?

A

execute operations on attacked host

33
Q

What happens in a local attack?

A

the attacker manipulates the behaviour of applications through local injection

34
Q

What does a local attack assume?

A

there’s a previously established presence on the machine

35
Q

what is the goal of a local attack?

A

to execute operations with different/superior privileges

Computer and Network Security (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions