COMP 6370 test 2

Binary exploitation

techniques used to intentionally trigger bugs in a way that is meaningful to attackers

Fuzzers

program that drives another program feeding it unexpected output trying to get it to crash

bug progression

bug→ controllable → exploitable → predictable → useful

buffer overflow

vulnerability where a buffer is overwritten and arbitrary code execution is possible

NOP sled

A buffer overflow technique where the attacker feeds NOP(No Operation) instructions before the shell code to figure out where to place the shell code

shell code

a small piece of low-level machine or assembly code used as a payload to exploit software vulnerabilities

Nx bit

A solution to the NOP sled that marked parts of the stack non executable

return to libc

An attacker would execute a powerful C command like execv or execl(/bin/sh) which spawned a command shell on the host

Data Execution Prevention(DEP)

marks specific memory regions—such as the stack and heap—as non-executable to block buffer overflow and code-injection attacks

write xor executable

Ensures a file cannot both be written to and executable by XOR the settings together

stack canaries

a specific token that the compiler checks for with every instruction

Address Space Layout Randomization(ASLR)

a computer security defense that randomly arranges the memory locations of key process components—such as the stack, heap, shared libraries, and executable base—each time a program runs

return oriented programming(ROP)

an advanced computer security exploit technique that allows an attacker to execute arbitrary code on a target system using the code and stack that already exists

Integer Overflow

An attack passes in a negative signed number and it gets converted to a large unsigned

disassembler

Converts raw binary files to assembly code

decompilers

takes assembly code and turns it into C code

malware

software intentionally designed to operate in and for other’s advantage, negatively affecting victims

Trojan horse

A type of malware that hides its true intent, often masquerading as a legitimate program

Virus

a type of malware that spreads from program to program. Needs human interaction to spread

polymorphic virus

a virus that uses encryption or obfuscation so each copy is different

metamorphic virus

changes actual code but is still semantically similar to other copies

Worm

a virus that spreads to other machines automatically

cryptojackers

malware that infects a computer to steal CPU processing power for bitcoin mining

Botnet

A large network of infected hosts. Performs DDos attacks, prevents attribution.

Ransomware

Ransoms data from companies for money

Wiper

wipe/destroy a machine

Rootkit

allows you to hide on a system

Spyware

sends info about your system to another place

CVE

Common vulnerabilities and exposure

0-days

vulnerabilities that have not been discovered or patched yet

N-days

known vulnerability that has not been patched yet

Permavulnerabilities

vulnerability that is known and will not be fixed

Least Privilege

Limit the users privilege to the bare minimum need to do their jobs.

Complete Mediation

trusted entity validate privileged use

Security Models

an abstraction. Ex. subjects, permission, objects

Security Policy

mapping of subjects, permissions, and objects to implement a model

Security Mechanism

technical measure that enforces a policy

Formal Security Models

DAC

MAC

RBAC

Discretionary Access Control(DAC)

The owner of the resource decides who can access the resource and what they can do with it.

Mandatory Access Control(MAC)

operating system or database kernel centrally enforces access rules based on security labels, classifications, and user clearance levels

Role Based Access Control(RBAC)

All users/systems are assigned roles and access rules are enforced based on those roles and rules

subjects

users and groups

objects

files and directories

permissions

read,write and execute

Air-gapped systems

a system that has no connection to the internet

OS level isolations

hypervisors and VMs that have a separate OS.

Containers

enviroment level isolation. Ex. docker

process isolation

virtual memory, shared file system

Sandboxing

thread level isolation

Permission level isolation

SE Linux(Hard to configure but very secure if successful)

Virus Scanner

a software that searches for known viruses and malware on a system and removes them

Pros Virus Scanner

Alerts on known malware, quarantines suspects

Cons Virus Scanner

Only stops known malware

many false positives

Increases attack surface and touches all parts of computer system