COMPUTER CONTROL AUDITING AND SECURITY
Question 1
Which of the following aim to prevent buffer overflow attacks? (11.1)
A. writing code that is not vulnerable
B. protection of executable address space
C. detection of stack modifications
D. using the C programming language
E. All of the above
F. Only A, B and C above
Correct answer is F
Refer to your text, page 351, Computer Security Principles and Practice, Stalling & Brown, 2008.
Question 2
Which if the following programing languages are considered NOT safe from buffer overflow attacks?
A. Java
B. Python
C. C
D. ADA
Correct answer is C
The programming languages vulnerable to buffer overflows are those without a very strong notion of the type of variables, and what constitutes permissible operations on them. They include assembly language, and C and similar languages. Strongly typed languages such as Java, ADA, Python, and many others are not vulnerable to these attacks.
Question 3
Which of the following best describes a "return to system call" buffer overflow attack? (11.14, 11.15, 11.16)
A. the return address is changed to jump to existing code on the system, typically in standard libraries
B. the targeted buffer is located on the heap rather than stack
C. the targeted buffer is located in the global data area
D. flush firewall rules (such as IPTables and IPChains) that currently block other attacks
Correct answer is A
In a “return to system call” attack, typically a stack overflow is used, but the return address is changed to jump to existing code on the system, typically in standard libraries. This avoids triggering run-time defenses that block executable code on the stack or heap. They can be prevented using stack protection mechanisms.
In a “heap buffer overflow” attack, the targeted buffer is located on the heap rather than stack. These generally target either function pointers located adjacent to such buffers, or heap management pointers. These attacks avoid defenses that focus on stack based attacks. Defenses include making the heap non-executable, or randomizing addresses of structures on the heap.
In a “global data area overflow” attack, the targeted buffer is located in the global data area. The attack is similar to heap overflows, as are the defenses.
Question 4
___________ typically involves using client-side scripts written in JavaScript that are designed to extract information from the victim and then pass the information to the attacker. (12.6)
A. Sneaker Scripts
B. SQL injection
C. Cross site scripting (XSS)
D. SQL scripting
Correct answer is C
A cross-site scripting attack occurs when input provided to a program by one user, is subsequently output to another user. They are most commonly seen in scripted web applications, where the vulnerability involves the inclusion of script code in the HTML content of a web page displayed by a user’s browser.
Question 5
The principle of __________ in access control means that each user should be given only the minimal amount of privileges necessary to perform his or her job function (12.11)
A. Assumed Attacker (AA)
B. implicit deny
C. separation of duties
D. least privilege
Correct answer is D
The principle of least privilege states that programs should execute with the least amount of privileges needed to complete their function.
Question 6
____________ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol. (12.9)
A. White
B. Fuzz
C. Spike
D. Black
Correct answer is B
“Input fuzzing” is a software testing technique that uses very large amounts of randomly generated data as inputs to a program, to determine whether the program or function correctly handles all such abnormal inputs, or whether it crashes or otherwise fails to respond appropriately. The major advantage of fuzzing is its simplicity, low cost, and its freedom from assumptions about the “expected” input to any program, service or function. It ought to be deployed as a component of any reasonably comprehensive testing strategy, especially in relation to commonly deployed software.