Wagner Spring 2014 CS 161 Computer Security Midterm 1: (Last) (First)
Wagner Spring 2014 CS 161 Computer Security Midterm 1: (Last) (First)
You may consult one sheet of paper (double-sided) of notes. You may not consult other
notes, textbooks, etc. Calculators, computers, and other electronic devices are not permitted.
Please write your answers in the spaces provided in the test. We will not grade anything on
the back of an exam page unless we are clearly told on the front of the page to look there.
You have 50 minutes. There are 6 questions, of varying credit (100 points total). The
questions are of varying difficulty, so avoid spending too long on any one question.
Do not turn this page until your instructor tells you to do so.
Question: 1 2 3 4 5 6 Total
Points: 15 10 15 20 16 24 100
Score:
Page 1 of 7
Problem 1 Security principles (15 points)
For each scenario, identify the security principle illustrated by scenario and give a short
one-sentence justification of your answer. Some scenarios may represent an example of
following the principle; others may represent an example of violating the principle.
(a) Bike lock manufacturers tend to have a range of different kinds of locks for customers
to choose from. The high-end ones are advertised for high-crime areas and the low-
end options are advertised for low to moderate crime areas.
Principle:
Justification:
(b) Some paranoid people will equip their houses with high fences, a gate that only
opens with a password, a home security system, and a panic room.
Principle:
Justification:
(c) A company called ES&S makes electronic voting machines for use in public elections.
A special password is needed to upload software updates to their voting machines.
This password is identical for every ES&S machine throughout the country, hard-
coded in the code, and cannot be changed. The password is documented in manuals
given to election officials who need to update the software on their voting machines.
Principle:
Justification:
(b) ROP (Return-Oriented Programming) attacks are one way to exploit memory-safety
vulnerabilities. Which of the following defenses can defend against ROP attacks?
Circle all that apply.
Non-executable stack Random CSRF tokens
Same-origin policy Memory-safe programming languages
Output escaping
None of the above
(c) How could you, as the developer of CashBo, defend your web service from this sort
of attack? Explain in one or two sentences.
(c) If the vulnerable code was compiled using a compiler that inserts stack canaries,
would that prevent exploitation of this vulnerability? Answer yes or no. You do
not need to justify your answer.
(d) If the vulnerable code was run with DEP (Data Execution Prevention), would that
prevent exploitation of this vulnerability? Answer yes or no. You do not need to
justify your answer.
Reminder: DEP uses the NX (non-executable) bit to mark the stack and heap
regions as non-executable, so no page in memory is both writeable and executable.