Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Software Engineering > Quiz 2 > Flashcards

Quiz 2 Flashcards

1
Q

What is Concurrency?

A

The execution of multiple flows of operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What could occur if concurrency is not controlled?

A

Non-deterministic behavior could occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Race Conditions?

A

Software defects/vulnerabilities resulting from unanticipated execution ordering of concurrent flows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three properties of race conditions?

A

It must be concurrent, it must have a shared object and one of the controls must alter the state of the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Race Window?

A

A segment of code that access the race object in a way that opens a window of opportunity for a race condition (aka critical section)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some ways to avoid race conditions?

A

Ensure race windows do not overlap
Make them mutually exclusive
Use certain language facilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are Semaphores?

A

Data structures that provides mutual exclusion to critical sections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two operations in semaphores?

A

Wait(semaphore) decrement and block line of execution until open
Signal(semaphore) increment and allow another thread to enter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What occurs when wait() is called by a thread?

A

If a semaphore is open, the thread continues, else it blocks on a queue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What occurs when a semaphore is opened by a signal()?

A

If the thread is waiting on a queue the thread is unblocked
Else the signal is remembered for the next thread

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a deadlock?

A

A group of threads wait forever because each of them is waiting for resources that are held by another thread in the group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the two sources of race conditions?

A

“Trusted” control flows (highly coupled threads of execution)
“Untrusted” control flows (Separate application of process)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are ToC/ToU (Time of check time of use) race conditions?

A

A race condition where the race object is first checked then used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does a ToC/ToU attack work?

A

The attacker uses the gap between the checking of the object and the use of the object to alter the object to be used to cause the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are some common scenarios for double-fetch bugs to occur?

A

Dependency lookups
Protocol/signature checking
Information guessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a data race?

A

A type of race condition that occurs at the level of atomic memory accesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data races are the root cause of what?

A

Synchronization bugs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some ways to mitigate race conditions?

A

Eliminating the race object
Checking file properties securely
Mutual exclusion
Thread safe function
Using atomic operations
Controlling access to the race object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Race condition detection is what complete?

A

NP complete meaning that we can only approximate detection of race conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are some of the reasons for race condition detection being NP complete

A

Random time variants
Various different execution paths that could be taken
The time it takes to execute the analzation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the idea behind heap spraying?

A

Since browsers place the shellcode on the heap at an unknown location the idea is to “spray the heap” with a bunch of shellcodes there by making that its very likely that it will be chosen at random

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Heap spray can assist with what?

A

Bypassing the ASLR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are some defenses against heap spraying?

A

Protect heap function pointers
Have better browser architectures
Have heap overflow protection to prevent cross page overflows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Heap feng shui?

A

Reliable heap exploits on Internet explorer without spraying

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is vulnerable buffer placement?

A

Placing vulnerable buffers next to objects to cause an overflow to the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is javascript heap spraying?

A

Pointing the function pointer almost anywhere in the heap to cause the shellcode to execute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the goal of control flow hijacking?

A

To take control over a target machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are some common vulnerabilities in control flow hijacking?

A

Buffer overflow
Integer overflow
Format string vulnerabilities
UAF and Double-free

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are some common targets in control flow hijacking?

A

Return address
Vtable
Function pointer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are some common exploitations in control flow hijacking?

A

Code injection
Return to libc
Return oriented programming
Heap spraying

31
Q

What are some ways to make a process safe?

A

Control flow safety
Memory safety
Type safety

32
Q

What is control flow safety?

A

All control transfers are possible by the original program ie not jumps no call to library routines that the program did not call

33
Q

What is memory safety?

A

All memory accesses are correct, so array bounds are respected, other process’s memory is left alone, separation between code and data

34
Q

What is type safety?

A

All function calls and operations have arguments of a correct type

35
Q

What are some ways to defend against control flow hijacking?

A

Audit software
Identify vulnerabilities
Rewrite software in a type safe language

36
Q

What are stack canaries?

A

A segment of code on the stack that is checked occasionally to determine if it has been overwritten and if so stop the execution of the program

37
Q

How are some ways attackers can get around a stack canary?

A

By using a form of information leak to determine what the canary is and not overwriting it

38
Q

What does pointguard do?

A

Protect function pointers and setjmp buffers by encrypting them

39
Q

What are the two type of canaries?

A

Random canaries
Terminator canaries

40
Q

What are the attributes of a random canary?

A

Random string chosen at program startup
Insert the canary string into every stack frame
Verify canary before returning from the function

41
Q

What are the attributes of a terminator canary?

A

String functions will not copy beyond the terminator
Attacker cannot use string functions to corrupt the stack

42
Q

How does ProPolice improve stackguard?

A

It adds buffers after local pointers and function arguments in the stack frame

43
Q

What does the /GS option in visual studio implement?

A

A combination of propolice and random canary actions
If the cookie mismatches, call_exit(3)
In VS 2010 the protection is added to all functions unless it can be proven unnecessary

44
Q

What are some ways to evade /GS?

A

Overflow exception handler to the shellcode
Trigger the exception to hijack the control flow

45
Q

What is SAFESHE and SEHOP

A

SAFESEH is a linker flag that produces a binary with a table of safe exception handlers
The system will not jump to exception handler not on the list
SEHOP is a platform defense that adds a dummy record at the top of the SEH list. When an exception occurs the dummy is checked and if it is not there it terminates the program

46
Q

What are some exploits that can still occur even with canaries?

A

Heap-based overflows
Integer overflows
Use-after-free
Exception Handling attacks can still occur

47
Q

What is the solution to the stack smashing attacks?

A

Bridging the implementation and abstraction gap by separating the control stack

48
Q

What are the two segments of the safe stack

A

The safe stack and the unsafe stack

49
Q

What does the safe stack store?

A

Return addresses, register spills and local variables

50
Q

What does the unsafe stack store?

A

Everything that isn’t a return address, register spills and a local variable

51
Q

How is a safe stack actually implemented?

A

The safe stack is placed in a random place in the address space.

52
Q

What are the properties of intel’s upcoming shadow stack?

A

There is a new shadow stack pointer
call and ret automatically updates esp and ssp
The shadow stack cannot be updated manually

53
Q

What is Write or Execute?

A

Its hardware protection that ensures that memory cannot be both writeable and executable at the same time
Code is executable not writeable
Stack, heap, static variables writeable not executable

54
Q

What are some limitations to Write or Execute?

A

Some apps needs an executable heap
Doesn’t defend against code reuse attacks

55
Q

What is address space randomization?

A

The memory layout of a running process is randomized
The position independent code that can be loaded at any location is loaded at any location.

56
Q

What are some ways to bypass ASLR?

A

Brute force attacks
ROP exploits to exploit non-randomized memory
Exploiting information disclose bugs to reveal addresses

57
Q

What are some other code randomization beyond ASLR?

A

System call randomization
Instruction set randomization
Fine gained code randomization

58
Q

What is code obfuscation?

A

The generation or alteration of source code and or object code so that its hard to reverse engineer.

59
Q

What are the three main features of code obfuscation?

A

Potency
Resilience
Cost

60
Q

What are the 5 main methods of code obfuscation?

A

Lexical transformations
Control transformations
Data transformations
Anti-disassembly
Anti-debugging

61
Q

What is a reference monitor?

A

A monitor that observes the execution of the program/process on the hardware/OS/network level, if the process violates a policy it halts the execution of the program

62
Q

Where is the reference monitor placed in the kernelized system?

A

The kernel

63
Q

Where is the reference monitor placed in the wrapper system?

A

Around the program

64
Q

Where is the reference monitor placed in the instrumented program?

A

Inside the program

65
Q

How does the OS function as a Reference monitor?

A

By having a collection of running processes and files which has an access control lists which states which users can read/write/execute them
Also it enforces a variety of safety polices, like checking file access against the ACL, and enforcing isolation, privilege and sharing principles

66
Q

What is the Inline reference monitor?

A

An instrument program code to enforce expected behavior

67
Q

What are the principles of the Inline reference monior?

A

Complete mediation reference monitors must always be invoked
Tamper proof reference monitors cannot be modified by attackers
Verifiable correctness reference monitors correctness is preferably verifiable
Performance and compatibility

68
Q

What is Control flow Integrity?

A

A defense mechanism against control flow hijacking that employs inline reference monitors to enforce the run time control flow of a process must follow the statically computed control flow graph

69
Q

What are the steps of control flow integrity?

A

Compute the static CFG of the program
Instrument the program code with IRM
Insert monitors to ensure runtime execution always stays within the statically determined CFG

70
Q

What are the two CFI Policies?

A

Context insensitive and Context sensitve

71
Q

What is context insensitive CFI policies

A

No extra information is kept

72
Q

What is context sensitive CFI policies

A

The past execution history is kept

73
Q
A

Software Engineering (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions