Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Software Engineering > Quiz 2 > Flashcards

Quiz 2 Flashcards

(73 cards)

Start Studying
1
Q

What is Concurrency?

A

The execution of multiple flows of operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What could occur if concurrency is not controlled?

A

Non-deterministic behavior could occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Race Conditions?

A

Software defects/vulnerabilities resulting from unanticipated execution ordering of concurrent flows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three properties of race conditions?

A

It must be concurrent, it must have a shared object and one of the controls must alter the state of the object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Race Window?

A

A segment of code that access the race object in a way that opens a window of opportunity for a race condition (aka critical section)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some ways to avoid race conditions?

A

Ensure race windows do not overlap
Make them mutually exclusive
Use certain language facilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are Semaphores?

A

Data structures that provides mutual exclusion to critical sections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two operations in semaphores?

A

Wait(semaphore) decrement and block line of execution until open
Signal(semaphore) increment and allow another thread to enter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What occurs when wait() is called by a thread?

A

If a semaphore is open, the thread continues, else it blocks on a queue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What occurs when a semaphore is opened by a signal()?

A

If the thread is waiting on a queue the thread is unblocked
Else the signal is remembered for the next thread

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a deadlock?

A

A group of threads wait forever because each of them is waiting for resources that are held by another thread in the group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the two sources of race conditions?

A

“Trusted” control flows (highly coupled threads of execution)
“Untrusted” control flows (Separate application of process)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are ToC/ToU (Time of check time of use) race conditions?

A

A race condition where the race object is first checked then used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does a ToC/ToU attack work?

A

The attacker uses the gap between the checking of the object and the use of the object to alter the object to be used to cause the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are some common scenarios for double-fetch bugs to occur?

A

Dependency lookups
Protocol/signature checking
Information guessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a data race?

A

A type of race condition that occurs at the level of atomic memory accesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data races are the root cause of what?

A

Synchronization bugs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some ways to mitigate race conditions?

A

Eliminating the race object
Checking file properties securely
Mutual exclusion
Thread safe function
Using atomic operations
Controlling access to the race object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Race condition detection is what complete?

A

NP complete meaning that we can only approximate detection of race conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are some of the reasons for race condition detection being NP complete

A

Random time variants
Various different execution paths that could be taken
The time it takes to execute the analzation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the idea behind heap spraying?

A

Since browsers place the shellcode on the heap at an unknown location the idea is to “spray the heap” with a bunch of shellcodes there by making that its very likely that it will be chosen at random

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Heap spray can assist with what?

A

Bypassing the ASLR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are some defenses against heap spraying?

A

Protect heap function pointers
Have better browser architectures
Have heap overflow protection to prevent cross page overflows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Heap feng shui?

A

Reliable heap exploits on Internet explorer without spraying

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is vulnerable buffer placement?
Placing vulnerable buffers next to objects to cause an overflow to the object
26
What is javascript heap spraying?
Pointing the function pointer almost anywhere in the heap to cause the shellcode to execute
27
What is the goal of control flow hijacking?
To take control over a target machine
28
What are some common vulnerabilities in control flow hijacking?
Buffer overflow Integer overflow Format string vulnerabilities UAF and Double-free
29
What are some common targets in control flow hijacking?
Return address Vtable Function pointer
30
What are some common exploitations in control flow hijacking?
Code injection Return to libc Return oriented programming Heap spraying
31
What are some ways to make a process safe?
Control flow safety Memory safety Type safety
32
What is control flow safety?
All control transfers are possible by the original program ie not jumps no call to library routines that the program did not call
33
What is memory safety?
All memory accesses are correct, so array bounds are respected, other process's memory is left alone, separation between code and data
34
What is type safety?
All function calls and operations have arguments of a correct type
35
What are some ways to defend against control flow hijacking?
Audit software Identify vulnerabilities Rewrite software in a type safe language
36
What are stack canaries?
A segment of code on the stack that is checked occasionally to determine if it has been overwritten and if so stop the execution of the program
37
How are some ways attackers can get around a stack canary?
By using a form of information leak to determine what the canary is and not overwriting it
38
What does pointguard do?
Protect function pointers and setjmp buffers by encrypting them
39
What are the two type of canaries?
Random canaries Terminator canaries
40
What are the attributes of a random canary?
Random string chosen at program startup Insert the canary string into every stack frame Verify canary before returning from the function
41
What are the attributes of a terminator canary?
String functions will not copy beyond the terminator Attacker cannot use string functions to corrupt the stack
42
How does ProPolice improve stackguard?
It adds buffers after local pointers and function arguments in the stack frame
43
What does the /GS option in visual studio implement?
A combination of propolice and random canary actions If the cookie mismatches, call_exit(3) In VS 2010 the protection is added to all functions unless it can be proven unnecessary
44
What are some ways to evade /GS?
Overflow exception handler to the shellcode Trigger the exception to hijack the control flow
45
What is SAFESHE and SEHOP
SAFESEH is a linker flag that produces a binary with a table of safe exception handlers The system will not jump to exception handler not on the list SEHOP is a platform defense that adds a dummy record at the top of the SEH list. When an exception occurs the dummy is checked and if it is not there it terminates the program
46
What are some exploits that can still occur even with canaries?
Heap-based overflows Integer overflows Use-after-free Exception Handling attacks can still occur
47
What is the solution to the stack smashing attacks?
Bridging the implementation and abstraction gap by separating the control stack
48
What are the two segments of the safe stack
The safe stack and the unsafe stack
49
What does the safe stack store?
Return addresses, register spills and local variables
50
What does the unsafe stack store?
Everything that isn't a return address, register spills and a local variable
51
How is a safe stack actually implemented?
The safe stack is placed in a random place in the address space.
52
What are the properties of intel's upcoming shadow stack?
There is a new shadow stack pointer call and ret automatically updates esp and ssp The shadow stack cannot be updated manually
53
What is Write or Execute?
Its hardware protection that ensures that memory cannot be both writeable and executable at the same time Code is executable not writeable Stack, heap, static variables writeable not executable
54
What are some limitations to Write or Execute?
Some apps needs an executable heap Doesn't defend against code reuse attacks
55
What is address space randomization?
The memory layout of a running process is randomized The position independent code that can be loaded at any location is loaded at any location.
56
What are some ways to bypass ASLR?
Brute force attacks ROP exploits to exploit non-randomized memory Exploiting information disclose bugs to reveal addresses
57
What are some other code randomization beyond ASLR?
System call randomization Instruction set randomization Fine gained code randomization
58
What is code obfuscation?
The generation or alteration of source code and or object code so that its hard to reverse engineer.
59
What are the three main features of code obfuscation?
Potency Resilience Cost
60
What are the 5 main methods of code obfuscation?
Lexical transformations Control transformations Data transformations Anti-disassembly Anti-debugging
61
What is a reference monitor?
A monitor that observes the execution of the program/process on the hardware/OS/network level, if the process violates a policy it halts the execution of the program
62
Where is the reference monitor placed in the kernelized system?
The kernel
63
Where is the reference monitor placed in the wrapper system?
Around the program
64
Where is the reference monitor placed in the instrumented program?
Inside the program
65
How does the OS function as a Reference monitor?
By having a collection of running processes and files which has an access control lists which states which users can read/write/execute them Also it enforces a variety of safety polices, like checking file access against the ACL, and enforcing isolation, privilege and sharing principles
66
What is the Inline reference monitor?
An instrument program code to enforce expected behavior
67
What are the principles of the Inline reference monior?
Complete mediation reference monitors must always be invoked Tamper proof reference monitors cannot be modified by attackers Verifiable correctness reference monitors correctness is preferably verifiable Performance and compatibility
68
What is Control flow Integrity?
A defense mechanism against control flow hijacking that employs inline reference monitors to enforce the run time control flow of a process must follow the statically computed control flow graph
69
What are the steps of control flow integrity?
Compute the static CFG of the program Instrument the program code with IRM Insert monitors to ensure runtime execution always stays within the statically determined CFG
70
What are the two CFI Policies?
Context insensitive and Context sensitve
71
What is context insensitive CFI policies
No extra information is kept
72
What is context sensitive CFI policies
The past execution history is kept
73

Software Engineering (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions