IT 223 Lecture 11 Exam With Complete Solutions
3 categories of approaching application security - ANSWER Defensively,
Forensically, Offensively
Defensively approaching application security - ANSWER Securing services,
software, and network components
Forensically approaching application security - ANSWER Application security
can be understood by malware analysis because analysis reveals important
information about vulnerabilities.
Offensively approaching application security - ANSWER SQL injections and
database hacks.
Applications use temporary storage areas in RAM called _______? - ANSWER
Buffers
If an attacker sends code or a message that exceeds the programmer's
allocated amount of RAM it is an ___________? - ANSWER Buffer overflow
2 types of Buffer overflows - ANSWER Stack and Heap
Heap Overflow - ANSWER Memory on the heap is dynamically allocated by the
application at run-time and typically contains program data. Exploitation is
performed by corrupting this data in specific ways to cause the application to
overwrite internal structures.
Stack - ANSWER Is a memory structure to which data can be added ("pushed")
or removed ("popped").
Each unit of data pushed and later popped is called a _____________? - ANSWER
Stack frame
A stack frame contains? - ANSWER Space for data values to be passed to the
calling unit.
Space for a data value to be returned to the calling unit.
space for temporary variables to be used within the called unit
the memory address of the end of the frame
the return address (the memory location of the next instruction after the call)
Stack Overflow attack - ANSWER The attacker sends more data than the
programmer allowed. The excess data is carefully crafted to overwrite the
return address with the address of a memory location somewhere in the excess
3 categories of approaching application security - ANSWER Defensively,
Forensically, Offensively
Defensively approaching application security - ANSWER Securing services,
software, and network components
Forensically approaching application security - ANSWER Application security
can be understood by malware analysis because analysis reveals important
information about vulnerabilities.
Offensively approaching application security - ANSWER SQL injections and
database hacks.
Applications use temporary storage areas in RAM called _______? - ANSWER
Buffers
If an attacker sends code or a message that exceeds the programmer's
allocated amount of RAM it is an ___________? - ANSWER Buffer overflow
2 types of Buffer overflows - ANSWER Stack and Heap
Heap Overflow - ANSWER Memory on the heap is dynamically allocated by the
application at run-time and typically contains program data. Exploitation is
performed by corrupting this data in specific ways to cause the application to
overwrite internal structures.
Stack - ANSWER Is a memory structure to which data can be added ("pushed")
or removed ("popped").
Each unit of data pushed and later popped is called a _____________? - ANSWER
Stack frame
A stack frame contains? - ANSWER Space for data values to be passed to the
calling unit.
Space for a data value to be returned to the calling unit.
space for temporary variables to be used within the called unit
the memory address of the end of the frame
the return address (the memory location of the next instruction after the call)
Stack Overflow attack - ANSWER The attacker sends more data than the
programmer allowed. The excess data is carefully crafted to overwrite the
return address with the address of a memory location somewhere in the excess
