Tags: cs software_security

Q: What can a CSRF attack achieve?
A: The attacker can make requests with the victim's authority ("confused deputy")

Q: How does ASLR work?
A: The addresses of stack, heap, code, and data are randomized.

Q: The same origin policy states that code can only access [...] associated with [...].
A: resources such a cookies; the same URI scheme and exact hostname and port number

Q: How does a CSRF attack work?
A: Attacker inserts a request in e.g. the src attribute of an image, and the victim's browser makes the request, passing along any session cookies.

Q: How can you protect against a CSRF attack?
A: HTML-only: server embeds secret and unique token for each request, and verifies it
Header-based: web app sets cookie containing random token for the session, JS on client side (within same origin) copies it into custom HTTP header, server validates this.

Q: When can you use return-to-libc?
A: When libc is available to the program, and if you can reuse code to load values into the necessary registers (e.g. %rdi).

Q: How does DEP work?
A: The OS marks data pages as non-executable in page tables, and no memory is both writable and executable.

Q: Can you still exploit programs with DEP, and if so, how?
A: Yes, by reusing existing code, either via ROP or via return-to-libc.

Q: How can you attack ASLR?
A: Leak a pointer from stack/heap, and compute relative addresses

Q: How does shellcode injection work?
A: Attacker injects code into an executable area of memory (e.g. stack, if permissions allow), and overwrites a return address to point there.

Q: What steps does a shellcode need to do?
A: 1. Put string "/bin/sh" in memory
2. Put array in memory, containing pointer to "/bin/sh" and NULL pointer
3. Put pointer to the string in %rdi (progname)
4. Put pointer to the array in %rsi (argv)
5. Put NULL pointer in %rdx (envp)
6. Put system call number 0x3b in %rax (execve)

Q: What precautions do you need to take in a shellcode?
A: Avoid null bytes. So make offsets negative, xor a register and use that instead of 0, use movb instead of moving constants with explicit nulls.

Q: What's the difference between coarse and fine-grained CFI?
A: Coarse-grained CFI only uses a few labels: common label for all call sites, common label for all entry points

Q: How is fine-grained CFI implemented?
A: Valid targets have a label, and at runtime check that the program doesn't branch anywhere else.

Q: How can you still attack coarse-grained CFI?
A: Via ROP, with entry point and call site gadgets.

Q: How can you tell if there is a possibility of an SQL injection?
A: - negative approach: special characters in query cause an error
- positive approach: provide expression with special characters that wouldn't cause an error and see if it gets interpreted (e.g. string concat ''Foo, instead of 'Foo)

Q: How can you protect against an SQL injection?
A: Sanitize all input, use prepared statements.

Q: What can a format string attack achieve?
A: Arbitrary write

Q: In what domain does included external code execute?
A: In the same domain as the parent website.

Q: What is the one-time pad?
A: An XOR cipher with n-bit message and n-bit key.

Q: What does the one-time pad guarantee, and when?
A: Perfect encryption, if the key is perfectly random and you never reuse it

Q: strncpy(dst, src, n) only copies the null terminator if [...]. It does not add a null terminator if [...].
A: n < sizeof(dst); n is the size of dst

Q: What should you use instead of strncpy?
A: strlcpy, snprintf, strlen + memcpy

Q: When can you do an XSS attack?
A: If you can reflect the injected code (e.g. in an error page), or if you can store it on the server and later use it.

Q: How can you prevent XSS?
A: Everything returned to user that can be influenced by input must be sanitized.

Q: How does a TOCTTOU attack work?
A: If e.g. an application checks a symlink using an access() call, and only later uses it – the attacker can change the symlink in the meantime.

Q: How big is a char?
A: 8 bits (1 byte)

Q: How big is a short?
A: 16 bits (2 bytes)

Q: How big is an int?
A: 32 bits (4 bytes)

Q: How big is a long?
A: 64 bits (8 bytes)

Q: How big are pointers on x86_64 Linux?
A: 64 bits (8 bytes), with only lowest 48 bits used

Q: When is JIT-ROP needed and why?
A: To break fine-grained ASLR, because even relative addresses are randomized.

Q: How does JIT-ROP work?
A: Leak a single code pointer, then recursively: read target code page via code pointers, identify gadgets on that code page, and leak code pointers on that page.

Q: What's the difference between CBC and ECB?
A: ECB still reveals repetitions (such as in images); CBC doesn't, because each block depends on the previous block.

Q: What does httponly mean for cookies?
A: They're only accessible via HTTP requests, not client-side scripts.

Q: What does secure mean for cookies?
A: They can only be sent over SSL connections.

Q: What is BROP, and how does it differ from ROP?
A: ROP with only stop gadgets (never crashes), crash gadgets (always crashes), and useful gadgets (crash depends on return).

Q: What do you need for BROP to be possible?
A: A stack vulnerability (via stack reading), knowing how to trigger it, crash/no crash feedback with a respawning process

Q: What is Newton?
A: A framework for ROP gadget discovery at runtime, based on write constraints

Q: What are write constraints in Newton?
A: Limits on what memory the attacker controls

Q: What is the threat model for Newton?
A: ASLR + DEP + shadow stack. Attackers have arbitrary read/write, access to binary.

Q: How does a heap overflow work with dlmalloc?
A: You overflow a heap buffer to overwrite fd and bk fields in a free block. Then, when dlmalloc frees the used block, it'll unlink the adjacent free block, writing fd to bk+16 and bk to fd+24. You can then write to e.g. the GOT.

Q: How can a use-after-free be useful?
A: You can overwrite validated data with data that won't be validated, or bypass size checks

Q: What is tcache?
A: Per-thread per-size-class linked list of unused blocks, blocks are added here on free() and removed in LIFO order on malloc()

Q: How do you exploit tcache?
A: By overwriting the __free__ hook to call some other function.

Q: What can ASan detect?
A: Buffer overflow and use-after-free

Q: How does ASan work?
A: With shadow memory tracking allocation status, red zones between allocations, and a quarantine for deallocated memory

Q: What can DangSan detect?
A: Use after free

Q: How does DangSan work?
A: Keeps list of pointers to each object and shadow memory. On free, sets most significant bit of remaining pointers.

Q: What can Delta Pointers detect?
A: Buffer overflows

Q: How do Delta Pointers work?
A: Some bits of a pointer are used for metadata, and checks are implicit using MMU.

Q: What can't Delta Pointers detect?
A: Underflows

Q: How does BlindSide work?
A: Use buffer overflow to corrupt function pointer, execute it speculatively to probe memory, infer targets from measurable side effects of the probe

Q: Why is BlindSide useful?
A: It allows crash-free probing, due to speculation

Q: What can't you find in a BROP gadget, and where can you find it instead?
A: pop rdx; ret. Look instead for a strcmp