Project 1 Concepts Flashcards
T/F: Both the stack and the heap grow up in memory address space.
False. Stack grows down and heap grows up.
If a hospital worker changes a patient’s file without patients’ knowledge, what type of security principle have they broken?
a. Confidentiality
b. Integrity
c. Availability
d. Accountability
b. Integrity (page 25 in book)
Which of the following is not a vulnerability of passwords?
a. Offline dictionary attacks
b. Specific account attack
c. Workstation hijacking
d. Electronic monitoring
e. None of the above
e. None of the above (page 71 in book)
A root kit can be classified into [….] this is when the rootkit intercepts calls to API’s and modifies the returned results
a. memory based
b. user mode
c. kernel mode
d. external mode
b. user mode (page 212 book and rootkit lecture)
What type of rootkit cannot survive a reboot and why not?
a. Kernel mode because there is no user intervention
b. Persistent rootkits because the firewall flushes the rootkit out
c. Memory based because there is no persistent code
d. External mode because it is located in the files
c. Memory based because there is no persistent code
Put the following statements, regarding the sequence of calls made made by a function call to the stack, in the correct order:
A. Allocate space for local variables by moving the stack pointer down to leave sufficient room for them.
B. Push the parameters for the called function onto the stack.
C. Run the body of the called function.
D. Execute the return function which pops the saved address off the stack and returns control to the calling function.
E. Push the current frame pointer value (which points to the calling routine’s stack frame) onto the stack.
F. Executes the call instruction to call the target function, which pushes the return address onto the stack.
G. Pops the old frame pointer value (restoring the link to the calling routine’s stack frame).
H. Sets the frame pointer to be the current stack pointer value, which now identifies the new stack frame location for the called function.
I. Set the stack pointer back to the value of the frame pointer.
B. Push the parameters for the called function onto the stack.
F. Executes the call instruction to call the target function, which pushes the return address onto the stack.
E. Push the current frame pointer value (which points to the calling routine’s stack frame) onto the stack.
H. Sets the frame pointer to be the current stack pointer value, which now identifies the new stack frame location for the called function.
A. Allocate space for local variables by moving the stack pointer down to leave sufficient room for them.
C. Run the body of the called function.
I. Set the stack pointer back to the value of the frame pointer.
G. Pops the old frame pointer value (restoring the link to the calling routine’s stack frame).
D. Execute the return function which pops the saved address off the stack and returns control to the calling function.
p. 327 of text
The _________ contains the base address of data stored within the stack for the current procedure.
Answer EBP Register
Which of the following functions can lead to a buffer overflow vulnerability:
A.) gets() & fgets()
B.) gets() & strcpy()
C.) main() & gets()
D.) strncpy() & gets()
Answer B
T/F: Communication links, bridges, and routers are considered as assets to protect.
True
Source: book p.7
T/F: Passive network attacks are difficult to detect but can be prevented ; Active network attacks are difficult to prevent altogether but can be detected.
True
book p. 15
According to RFC 4949 there are four kinds of threats which threat consequence is not part of RFC 4949?
A.) Unauthorized Disclosure B.) Deception C.) Usurpation D.) Corruption E.) Disruption
Answer D
Corruption is a type of disruption where disruption is a threat consequence and and corruption is the threat attack.
Page 9
____________, a design principle for secure systems, states that security measures can not be bypassed.
A) Least Privilege B) Fail-Safe Defaults C) Economy of Mechanism D) Open Design E) Complete Mediation F) Psychological Acceptability
Answer E)
Complete Mediation - no one should be able to bypass security measures. “Every access to every object is checked” (Schneider)
Source: Lecture 1 “How Do We Address Cyber Security?” Schneider, Fred.
Which of the following statements is false?
A. Client attacks are when an adversary attempts to masquerade as a legitimate user.
B. Host attacks are directed at the user file on the host where passwords, tokens, etc are stored.
C. One form of eavesdropping refers to attempting to learn the password by observing the user.
D. Reply attacks are when an attacker repeat a previously captured user response.
E. A trojan horse attack is when an attacker when malicious hardware / software is used to log a user’s keystrokes.
F. A denial of service attack is when an attack disables user authentication service by flooding it with numerous authentication attempts.
Answer E
In a trojan horse attack, an app or device masquerades as an authentic application or device for the purpose of capturing a user password, passcode, etc. Example: rogue bank machine used to capture user’s card / PIN.
Source: Book pg. 97
For a C program, when is a stack frame allocated on the stack?
a. At compile time
b. When any function is entered
c. When any function is exited
d. At run time
Correct Answer: B
For a C program, when is a stack frame de-allocated from the stack?
a. When any function is entered
b. At run time
c. When any function is exited
d. At compile time
Correct Answer: C
