Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Real Midterm > Flashcards

Real Midterm Flashcards

1
Q

The returns of strcpy() store in what register that have the address of what buffer?

A

EAX, Destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following step/steps is/are required to execute a shell code in memory?

A

Find the vulnerability, store the shellcode to the executable memory, hijack control flow/EIP to shellcode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Will comparing a signed integer with an unsigned integer cause an integer overflow?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why is it important to execute an exit() syscall for the code reuse attacks?

A

To avoid a crash and leave no attack trace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which one of the following is a safe libc function?

A

strncpy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A shell code can be used for what?

A

Creating a new user, changing user password, opening a connection to the attackers machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Suppose we have the following gadgets
G1:
pop %ebx
ret
G2:
pop %ecx
ret
G3:
movl %ebx, %(ecx)
To achieve the following operation, determine the order of gadgets
store 10 at memory address 0x805000

A

G2, 0x805000, G1, 10, G3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NOP equivalence for stack pointer (esp) move is a gadget that only contains a what instruction?

A

ret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Finding gadgets is traditionally a what recursive traverse algorithm and searchable through a what representation?

A

Backward, Trie

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or false: Type confusion bugs are caused by inappropriate up-casts.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Direct function calls are what?

A

Not exploitable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

For ROP attacks, any gadget should ends with a what instruction?

A

ret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The leave instruction (AT&T) combines what instructions?

A

mve %ebp, %esp
pop %ebp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Format string specifier %n is significant for what?

A

Writing the number of characters printed so far in a pointer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The following order can be used in position independent shellcode to get the address of a string

A

Execute jmp to a call instruction sits right before the string, then call instructions goes back to jump+1 after pushing to the return address to the stack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False: In a double free, an exploitation occurs when the program calls free(q) on a region that contains data set by the attacker and the second free(q) will try to use the fake chunk tag.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The ret instruction is equivalent to what?

A

pop %eip

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

To execute a system call, a shellcode must contain what?

A

Store syscall id in EAX register

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why is it difficult to detect a Use-After-Free vulnerability?

A

They only exist in a particular execution path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Code reuse attacks can bypass what defenses?

A

Code signing and Write or Execute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What vulnerability is a double fetch bug a form of?

A

A race condition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

In Stack Guard implementation the function prologue does what?

A

Stores a canary word between return address and locals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

/GS protection alone is not enough to defend against exception handler based exploits because?

A

The exception is triggered before the canary is checked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In StackGuard implementation the function epilogue does what?

A

Checks canary before the function returns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

True or False: Context sensitive CFI policy is simple but imprecise compared to Context-insensitive CFI policy

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The most popular target of heap spray attacks is what?

A

Browser code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of the following register is used by the GCC stack smashing protector to locate the random canary?

A

%gs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A terminator canary may consist of what?

A

\n\n\n\n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following address randomizations is widely deployed?

A

Address space layout randomization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which of the following principles should be maintained by an inline reference monitor?

A

Reference monitors must always be invoked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where can a reference monitor be implemented?

A

Wrapping around the target program, inside the kernel or inside the target program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The probability of a successful heap spray attack does not depend on

A

The length of each targeted sensitive object in the memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

StackGuard protection can be bypassed by what?

A

Leveraging information leak vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

/GS Stack frame stores the exceptional handlers just before what?

A

The canary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which of the following is not a component of CFI defense mechanism?

A

Code Obfuscation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Applications with Write or Exectute (W^X) protection, their stack/heap memory is what?

A

Writable, but not executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Race windows in a Race condition is a what?

A

Code segment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

A race condition vulnerability must consist of what?

A

A concurrency property
A shared object property
A change state (share object) property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

In ProPolice protection mechanisms, in addition to canaries?

A

Local variables are rearranged by their types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Intel CET Shadow Stacks maintain a shadow copy of what?

A

The return address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is a buffer overflow?

A

A buffer overflow is when data is written outside the bounds of the allocated buffer space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Why are buffer overflows common in C/C++ programs?

A

They are common in C/C++ programs because there are not automatic bounds checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What can buffer overflows be leveraged to do?

A

Hijack the control flow of a program and execute arbitrary code by overriding the function pointers or return addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are some common unsafe C functions that can allow attackers to perform buffer overflows?

A

strcpy, strcat, gets, and scanf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is a safeish libc function?

A

strncpy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is commonly used to identify potential buffer overflows?

A

Fuzz testing (by using random inputs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What can address sanitizing do to help detect buffer overflows?

A

They help detect out of bound writes during testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

When the return address is overwritten by an attacker during a stack buffer overflow what can occur?

A

The program can then be used to jump to the attackers code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are some defenses against buffer overflows?

A

Bounds checking, canaries, ASLR ie randomizing the addresses, and using safer functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What was the first major exploit of buffer overflows?

A

The internet worm using the fingerd service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are some targets for control flow hijacking using buffer overflows?

A

Function pointers
exception handlers
vtables
longjmp buffers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are heap based buffer overflows?

A

When the allocated heap buffer is overflowed and causes the overwriting of the adjacent heap metadata structures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Why do some defense mechanisms not get implemented?

A

Because of performance overhead concerns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are type confusions?

A

Vulnerabilities that occur when code accesses a memory resource using an incompatible type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Why does type confusions often occur in C/C++?

A

There are no runtime type safety checks so pointers can be cast to incompatible types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are some different casting operations that could cause type confusion?

A

Static casting with static_cast
Dynamic casting with dynamic_cast
C-style casting with (Type)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a common cause of type confusion bugs?

A

Illegal downcasts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are some defenses against type confusion bugs?

A

Runtime type checking, strict casting rules and using type safe languages like java

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is an integer overflow?

A

An integer value that exceeds its maximum value and as a result wraps around

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Can converting from a signed to an unsigned integer cause an integer overflow?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the best practices for using integers?

A

Using size_t when needing the size of a count
Using uint8_t for specific bit-width
Using intptr_t to have an integer to hold a pointer

62
Q

How do format string bugs occur?

A

When user-controlled inputs are passed as the format string parameters to certain functions

63
Q

What are some common specifiers using in format string bug attacks?

A

%p %d %c %u %x %s %n

64
Q

What is a use after free bug?

A

A program continues to use the memory after it has been freed, leading to an accessing deallocated or stale memory

65
Q

What is the cause of use after free bugs?

A

Wrongly handled error conditions, unaccounted for program states, confusion over which part of the code is responsible for freeing the memory

66
Q

How can use after free bugs be exploited?

A

By leading the program to allocate memory over the previously freed area. That area could contain code that the attacker placed there to be used for his advantage

67
Q

Why are use after free bugs hard to detect?

A

They only manifest in certain states of program execution
The bug is not visible at the time of the free call

68
Q

What are some prevention methods around use after free bugs?

A

Setting freed pointers to null and checking for null before being used

69
Q

What is a double free vulnerability?

A

When the same region of memory is freed twice without it being reallocated again in between

70
Q

What is shellcode?

A

Executable code used by attackers to achieve arbitrary code execution after hijacking the control flow

71
Q

What can the shellcode do?

A

Nearly anything like creating users, opening backdoors or spawning shells, changing the password of a user

72
Q

What are some solutions to find the addresses of parameters and setting the return addresses?

A

NOP sleds and position-independent code

73
Q

What are some attacks that can bypass Write or Execute defenses?

A

Return to libc or return oriented programming

74
Q

Hoes does ROP work?

A

By chaining together gadgets ending in return instructions to achieve arbitrary computation without code injection.

75
Q

What are the building blocks of ROP?

A

Constants, control flow, and multiple gadgets

76
Q

What are the steps of executing a system call?

A

Store syscall number in eax
Save arg 1 iin ebx, arg 2 in ecx and arg3 in edx
Execute int 0x80 or sysenter
Syscall runs and returns the result in eax

77
Q

What are some solutions to knowing the address of memory based parameters?

A

Pushing the address to the stack and getting addr from esp
Using position independent code

78
Q

How and why are NOP sleds used?

A

NOP sleds are used to help approximate the return addresses for the shellcode
NOPs simply advance the instruction pointer until it hits the shellcode

79
Q

What are the two main types of code reuse attacks?

A

Return to libc and return oriented programming

80
Q

How does ROP approximate constants?

A

Storing the constants on the stack, popping the constants into the register to use

81
Q

How does ROP approximate the control flow?

A

Conditionally setting the EIP to new values

82
Q

What is an example of an ROP using multiple gadgets to load memory into a register

A

Loading the address of a source word into %eax
Loading the memory into (%eax) into %ebx

83
Q

What are some recent advances in ROP?

A

Just in time ROP
Blind ROP
Block Oriented Programming Compiler

84
Q

What is the use of Just in Time ROP?

A

Defeating fine grained code randomization
Recusrively exploiting a memory disclosure to map the code of the victim process on the fliy
Discovering gadgets and JIT complie a ROP program

85
Q

What is Blind ROP?

A

Remote brute forcing an ROP without knowing the target program

86
Q

What is Block Oriented Programming Compiler?

A

Automatically synthesizing arbitrary turning complete data only payloads

87
Q

What is Ret2ret?

A

Overwriting one byte of the stack pointer with 0 to make it point to the shellcode
The vulnerable buffer sits lower on the stack than the pointer

88
Q

What is Ret2eax?

A

Overflowing the buf in msglog to place the shellcode in buf
strcpy saves the buf address in eax
Hijacking control flow to a subsequent call *eax and running the shellcode from there

89
Q

What is required for a race condition to occur?

A

2 concurrent control flows accessing a shared object with at least one flow altering the object state

90
Q

What is a race condition?

A

The ordering of execution of concurrent threads results in unintended behavior due to unanticipated timing

91
Q

What is the code that access the shared object that could result in a race condition called?

A

Race window or critical section

92
Q

What can be used to avoid race windows overlapping?

A

Synchronization primitives such as mutexes and semaphores

93
Q

What are some ways to avoid race conditions?

A

Mutual exclusion, avoiding sharing, atomics and static/dynamic analysis

94
Q

What is heap spraying?

A

Filling the heap with shellcode and NOP sleds to make it more likely that a control flow hijack will hit

95
Q

What are some defenses against heap spraying?

A

Heap layout randomization, isolating browser and javascript heap

96
Q

What are the source of race conditions

A

Trusted (highly coupled threads of execution) or untrusted (separate application of processes)

97
Q

What is a double fetch bug?

A

A bug that occurs when the same data is fetched twice from memory by a program

98
Q

What are some scenarios that could lead to double fetch bugs?

A

Dependency lookup (retrieving some dependent information which gets changed by another thread before being used)
Protocol/signature checking
Information guessing

99
Q

How does a data race occur?

A

When two or more threads access the same memory location concurrently

100
Q

What is heap spraying?

A

Filling the heap with a large amount of attack payloads

101
Q

What is used to spray the heap with shellcode and NOP sleds?

A

Javascript

102
Q

What is pointed in the spray area during a heap spray?

A

The vtable pointer

103
Q

What is a vulnerable buffer placement?

A

Placing a vulnerable buf next to an object

104
Q

What does a nozzle do?

A

Detects heap sprays by checking the prevalence of code on the heap

105
Q

What does OpenBSD do?

A

Prevent cross page overflow

106
Q

What is the aim of attackers

A

To hijack the control flow and execute arbitrary code

106
Q

What are some defenses against attackers

A

Canaries
Write or Executable
StackGuard/ProPolice
SAFESEH/SEHOP
Shadow Stacks/Safe Stacks
Address Randomization
Obfuscation
Reference Monitors
Control Flow Integrity

106
Q

What are some targets of attackers?

A

Return addresses
Vtables
Function pointers

107
Q

What are canaries?

A

A technique used to detect stack based buffer overflows

108
Q

The function prologue places a canary value where?

A

Between the return address and local variables

109
Q

The function epilogue does what?

A

Checks if the canary is unchanged before returning

110
Q

What did Stack Guard originally do?

A

Added canaries

111
Q

What are the two types of canaries?

A

Random canaries where a random value is chosen at the program start and inserted in each stack frame and
Terminator canaries a special value that string functions will not copy over

112
Q

How did ProPolice improve stackguard?

A

by reordering stack variables to protect pointers

113
Q

What does VS /GS option do?

A

Combines ProPolice and random canaries and calls exit() on a mismatch

114
Q

What are some things canaries cannot protect against?

A

Heap overflows or integer overflows

115
Q

What is the point of shadow and safe stacks?

A

To separate control data from user data

116
Q

Shadow stacks maintain a separate stack for what?

A

Return addresses

117
Q

Safe stacks splits the program stack into two regions for what?

A

A safe region for control data and an unsafe region for other data

118
Q

Can safe stacks be implemented in compilers (LLVM and GCC)

A

Yes

119
Q

Intel’s new shadow stacks will do what?

A

Have a new shadow stack pointer that call/ret updates automatically

120
Q

Shadow stacks rely on what assumption?

A

That the location of the shadow/safe stack is hidden from attackers

121
Q

Code pages are marked as what in W^X?

A

Executable but not writable

122
Q

Data pages (stack, heap, globals) are marked as what?

A

Writable but not executable

123
Q

W^X is supposed to prevent what?

A

Code injection atacks

124
Q

What does W^X not protect against?

A

Code reuse attacks like return to libc or ROP as the reuse existing code

125
Q

If an executable heap is needed what could be used to circumvent W^X?

A

Heap sprays

126
Q

What does ASLR do?

A

Randomize the memory layout of a process to make exploits harder

127
Q

What does ASLR do in reguards to exploits like return to libc and stack/heap overflows?

A

Make them probalistic

128
Q

What are some ways to override ASLR?

A

Brute force mechanisms, leaking the addresses through other bugs or using code gadgets that are not ranodmized

129
Q

What does fine grained code randomization do?

A

Randomizes code within programs and libraries themselves

130
Q

At what level does fine grained techniques randomize code?

A

Function, basic block or instruction level

131
Q

Function block randomization does what?

A

Shuffles the order of functions within each code section

132
Q

Basic block randomization does what

A

Randomizes the order of basic blocks within each function

133
Q

Instruction level randomization does what?

A

Changes the order of instructions within basic blocks through the insertion of unconditional jumps

134
Q

What is code obfuscation?

A

Transforming programs to make them more difficult for humans to understand while preserving semantics

135
Q

What is the purpose of code obfuscation?

A

To protect intellectual property and prevent reverse engineering

136
Q

What are some obfuscation techniques?

A

Lexical transformation
Control transformations
Data transformation
Anti-disassembly tricks
Anti debugging tricks

137
Q

What are some metrics to judge code obfuscation?

A

Potency, resilience, and low overhead

138
Q

What is lexical transformation?

A

Var names becoming nonsense

139
Q

What is control transformations

A

Changing the program flow and logic structure while maintaining functionality

140
Q

What is data transformations?

A

Modifying data structures and represenations

141
Q

What are anti debugging tricks?

A

Tricks to detect and impede debuggers

142
Q

What are reference monitors?

A

A component that monitors a systems execution to enfore compliance with a security policy

143
Q

What are the principles of reference monitors?

A

Complete mediation
Tamperproof
Verifiable
Low overhead

144
Q

What is the purpose of CFI?

A

To prevent control flow hijacking by ensuring software execution stays within a predetermined control flow graph

145
Q

How can the effectiveness of a CFI be measured?

A

By the largest and average EC size

146
Q

What is a EC?

A

A group of targets that CFI cannot distinguish/separate

147
Q

When are CFG computed?

A

Statically through program analysis

148
Q

What is SAFESEH?

A

A linker that produces a binary with a table of safe exception handlers

Cyber Security (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions