Font size
WorksheetsWeek 10 - Software security
Total questions: 13
Worksheet time: 26mins
Which of the following(s) describes Command Injection
Exploiting the vulnerability of accepting unexpected user input
inserting new malicious code into a vulnerable application, which executes
Executing arbitrary commands in a system shell or other parts of the environment
To override original command, gain access to a system, obtain sensitive data
Buffer overflow: A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. This holding area for the buffer is known as a ... ?
(a)
Which of the followings are techniques used in Good Programming practices to prevent command injection?
Secure programming - nothing is assumed
Use safe APIs instead of unsafe APIs
Proper input validation (black/whitelist)
Enable CORs to prevent malicious codes accessing unauthorized memory
strcpy(dest, src) is considered unsafe compared to its counterpart strncpy(dest, src, num). What does the parameter 'num' do?
It ensures that the char length is equal or smaller than num
It ensures that the char length is equal to num
It ensures that the char length is larger than num
It ensures that the address is num
Buffer overflow Counter measure: System supports
Which of the following are system support techniques
Immutable code and inexecutable data in the memory
Use memory safe languages
Address randomization when program is launched
Control flow integrity enforcements
Which system supports does this:
The OS has an ACL-like approach to specify whether bytes in a memory region can be read, written or executed
Immutable code and inexecutable data in the memory
Address randomization when a program is launched
Control flow integrity enforcement
Discretionary Access Control
Memory safe languages have bult-in defense against memory errors because they have inbuilt interpreters. Which languages are NOT memory safe
C#
C++
C
Rust
Which type of malware(s) have the following properties:
Non-replicating
Parasitic
Virus
Trojan horse
Time bomb
Logic bomb
Which type of malware(s) have the following properties:
Self-contained
Worm
Bot
Virus
Logic bomb
Malware have many ways to conceal themself. Which of the following malware that has these traits:
- Encrypt itself
- Change its code
- Core behavior remains the same
Metamorphic virus
Polymorphic virus
Encrypted virus
Endomorphic virus
Which is/are not a trait in static malware analysis
Check features such as file name, hashes (e.g.,MD5 checksums), file type, file size
Analyze its source code or binary code to understand its behaviors
Control malware execution to collect the malware’s runtime behavior such as API calls, data flow, network traffic, etc
Monitoring malware behaviour is VMs
Which system supports does this:
During execution, the program checks whether a control transfer destination inuse violates predefined policies.
Immutable code and inexecutable data in the memory
Address randomization when a program is launched
Control flow integrity enforcement
Mandatory Access Control
Which of the following statements are FALSE about countermeasures for software vulnerabilities?
Good programming practices such as the use of safe APIs or proper input validation are good countermeasures against software vulnerabilities
Whitelist and blacklist are measures used in input validation
Memory address randomization is a common measure used to reduce the effectiveness of buffer overflow
Putting code/data in unmodifiable/non-executable memory regions can be an effective way to prevent Worms
