What is Alternate Encodings?
- Has multiple means of encoding
- Unicode used for internationalisation
- Uses 16-bit value for characters
- Uses UTF-8 encodes as 1-4 byte sequences
Canonicalisation
- Transform input > single, standard, minimal representation
- Input is compared with single representation of acceptable input values
How is Numeric Input validated?
- Stored in fixed-sized values
- 8, 16, 32, 64 bit integers
- Values can signed or unsigned
What is Input Fuzzing?
- A software used for input testing randomly generated data
- Inputs are LARGE
- Inputs determines that it handles abnormal inputs
Disadvantages:
- Bugs trigger by other forms of input would be missed
How do you ensure Machine Language Corresponds to Algorithm?
- Issue ignored by most programmers
- Requires comparing machine code + original code
- Slow and difficult ->>>>> EXPENSIVE!!!
- Very high assurance level ‘EAL 7’ requires CHECKING
How to Correctly use memory?
- Dynamic memory allocation
- Used to manipulate unknown amounts of data
- Allocated when needed, released when done
- No memory left to run >>>> CRASH/HANG
- Memory leak
- Memory unavailablity on the heap > memory exhaustion
- No explicit support in dynamic memory
- Standard library routines used to _release memory _
What is Race condition?
- Synchronisation of access “at the same time”, can lead to loss due to overlapping access/use
- Two or more threads can access shared data and they try to change it at the same time.
- Because the thread scheduling algorithm can swap between threads at any time, you don’t know the order in which the threads will attempt to access the shared data.
Example: Withrdrawing money at the same time
What is a Deadlock?
Deadlock occurs when there is a conflict of a shared resource –
“Waiting for another for who is using the same resource”
What is Environment Variables?
- Collection of string values that inherits from the parent
- Affects the way a running process behaves
- Included in memory
- Can be modified to pass onto **children **
- Another source of untrusted program input > Corruption!
What is the use of Least Privileges?
- Escalates privileges (Gives attackers privileges)
- Least privileges (to run programs to complete function)
- Determines appropriate **user group privileges **(Granted for group or users)
- Ensures the program only modifies files and directories
- Runs macros to know that it is from the legitimate user
What is Root/Administrator Privileges?
- Programs with root privileges are a major target of attackers
- Provides the highest levels of system access + control
- Needed to manage access to protect system resources
- Provides isolation between components
- Reduces the consequences of security breech in one component
System calls and Standard Library Functions
- Programs use system calls and standard library functions for common operations
- If incorrect behaviour > optimising access to shared resources
- Services become buffered, resequenced
How to prevent Race Conditions?
- Programs need to access a common system resource
- Need synchronisation mechanism
What is a Lockfile?
Process must create and own the lockfile to gain access to shared resource
Concerns:
- If program ignores the lockfile + shared resource, the system will prevent this
- Implementation
How to Safely use Temporary Files
- Programs use temporary files in shared system area
- Must be unique, not shared by others
- Create name using process ID
- Must be secure + use random names
What is Malware Countermeasures?
List the 4 main elements of prevention + Threat mitigation
Solution of malware prevention
Four main elements of prevention
- Policy
- Awareness
- Vulnerability Mitigation
- Threat Mitigation
Threat mitigation options:
- Detection
- Identification
- Removal
Generations of Anti-Virus software
- First generation: Simple scanners
- (Requires malware signature to identify the malware
- Limited detection)
- Second generation: Heuristics scanners
- Uses heuristics rules
- Integrity checking
3. Third generation: **Activity Traps**
- Identifies malware by its actions BEFORE infected programs
4. Fourth generation: Full-featured protection
What is Generic Decryption? List what GD scanner contains
Anti-virus detects the complex polymorphic viruses + malware
Run GD scanner which contains:
- CPU emulator
- Virus Signature
- Emulation Control module
What is Host-Based Behaviour Blocking Software?
A host computer that monitors the program behaviour in real time for malicious action
- Blocks potential malicious attacks BEFORE it affects the system
- Blocks software in real-time
What are the Two types of monitoring software?
Ingres monitors:
- Located at the border between enterprise network and the internet
- Technique: look for incoming traffic to unused local IP address
Engress monitors:
- Located at the engress point of individual LANS + border between the enterprise network + internet
_Monitors traffic signs scanning + suspicious behaviour _
What is Worm Countermeasure? What are the 6 defences?
Anti-virus can detect + remove it
Worm defences:
- Signature-based worm scan filtering
- Filter-based worm containment
- Payload classification-based worm containment
- Threshold random walk, scan detection
- Rate limiting
- Rate Halting
What are the four lines of DOS Attack Defence?
Four lines of defence against DDoS attacks:
- Attack prevention + pre-emption
* BEFORE attack- Attack detection + filtering
- DURING the attack
- Attack source and traceback and identification
- DURING + AFTER the attack
- Attack reaction
- AFTER the attack
- Attack detection + filtering
What is DOS Attack Prevention?
- Block IP directed broadcasts
- Block suspicious services and combination
- Manage application attacks with graphical puzzle
CAPATCHA (Completely Automated Public Turning test to tell Computer and Humans Apart –
to distinguish human request
How to respond to DOS attacks?
- Antispofing
- Limit filters should be implemented
- Ideal for network monitors
- IDS to detect notify abnormal traffic patterns
- Requires good incident response plan
- Contact technical for ISP
- How to respond to attack
Steps to responding to DOS Attack
- Identify attack
(Capture + analyse packets
Block attack traffic upstream)
- Have ISP to trace the packet flow back to source
- Implement a plan (Such as a backup server)
- Update incident response plan
- Analyse attack for future response handling
