CSIT 460 Computer Security - Lecture 05

Flashcards covering attack vectors, Set-UID programs, and ShellShock attacks from the lecture notes.

What are the attack vectors of Set-UID Programs?

System inputs that can be controlled by users, user inputs, environment variables and non-privileged process controlled by user.

What is Buffer Overflow?

When a program accepts more input than it expects, causing it to overwrite memory. Attackers can run their own code with high privileges.

What is Format String Attack?

When user input is used directly as a format string in functions like printf(). Attackers can read or write memory or crash the program.

How to prevent Buffer Overflow and Format String Attacks?

Validate and limit user input size and never use user input directly as a format string.

What are System Inputs in the context of attack vectors?

Files or resources on the system that Set-UID programs use and that users can influence.

What is a Race Condition?

When a program's behavior depends on the timing of actions and attackers can exploit this by quickly changing files or links between security checks and program actions.

What are Environment Variables?

Key-value pairs that store information about the execution environment of a program. They are often used for configuration, storing paths, and other runtime settings.

What are the types of environment variables?

Inherited from parent process, shell configuration files, and user-defined settings.

What is the purpose of the PATH environment variable and what is a potential risk?

Tells the system where to find programs to run. If someone changes it, they can make the system run a fake or harmful program instead of the real one.

What is the purpose of the HOME environment variable?

Shows where your personal files and settings are. Many programs use this to find your files.

What is the purpose of the USER / LOGNAME environment variable?

Shows who is currently using the system. Programs and scripts use this to know who you are.

What is the purpose of the SHELL environment variable?

Decides which command-line shell (like bash) you use. This affects how commands and scripts are run.

What is the purpose of the PWD environment variable?

Shows your current folder. Some programs use this to find files or settings.

What is the purpose of the LANG environment variable?

Sets the language and region for programs. If these are set to strange values, programs might not work right or could act unexpectedly.

What is the purpose of the LDLIBRARYPATH environment variable?

Tells the system where to look for extra code libraries. If set incorrectly, it can make programs use bad or harmful code.

What is the purpose of the EDITOR / VISUAL environment variable?

Says which text editor you like to use. Some tools use this to open files for editing.

What is the purpose of the TMPDIR environment variable?

Points to the folder for temporary files. If this isn’t set safely, attackers might trick programs or steal information.

What are Cron Job Misconfigurations in the context of attack vectors?

If scheduled tasks (cron jobs) are set up incorrectly, attackers could run their own scripts with higher privileges than they should have, using environment variables or other tricks.

What are LD_PRELOAD Exploits in the context of attack vectors?

Attackers can use the LD_PRELOAD environment variable to tell programs to load malicious code libraries before anything else.

What was Shellshock (2014)?

A major security bug in the Bash shell where attackers could use specially crafted environment variables to make Bash run any command they wanted.

What is Common Gateway Interface (CGI)?

Lets web servers run scripts. When a user sends a request, the server puts information from that request into environment variables for the script to use.

How is Shellshock exploited via CGI?

An attacker sends a special web request with hidden commands in a header and if the CGI script uses Bash (the command-line shell), Bash might accidentally run the attacker’s command.