代做DSCI 525、Java/Python程序代写

日期：2024-04-15 08:43

Assignment 3

Objective

The objective of this assignment is to provide you the opportunity to apply secure software

development concepts studied in class.

Task 1 (50 points)

Answer the following questions.

1. The following program is vulnerable to a buffer overflow (assuming the absence of automated

defenses like ASLR, etc.).

a. What is the name of the buffer that can be overflowed?

b. What line of code can overflow the vulnerable buffer?

c. Recall the vulnerable overflow from the previous two questions. We can change one line of

code and make the buffer overrun go away. Which one-line change will eliminate the

vulnerability?

d. Which of the attacks that we studied do you think the program is susceptible to?

e. If we changed printf("%s",buf) to printf(buf) then the program would be

vulnerable to what sort of attack?

2. Recall Heartbleed attack.

a. What type of exploitation of the Heartbleed bug permits?

b. Why is it that anti-virus scanners would not have found an exploitation of Heartbleed?

3. Consider the following code:

char *foo(char *buf) {

char *x = buf +s trlen(buf);

char *y = buf;

while (y != x) {

if (*y == 'r')

break;

y++;

}

return y;

}

void bar() {

char input[10] = "test123";

foo(input);

}

The definition of spatial safety models pointers as capabilities, which are triples (p,b,e) where

p is the pointer, b is the base of the memory region the pointer is allowed to access, and e is

the extent of that region. Assuming characters are 1 byte in size, what is a triple (p,b,e) for the

variable y when it is returned at the end of the code?

4. In a return-oriented program (ROP), what is the role of the stack pointer?

5. A colleague proposes using a heap allocator that randomizes the addresses of allocated objects.

What is the impact of this design on security and performance?

6. Recall that classic enforcement of CFI requires adding labels prior to branch targets, and adding

code prior to the branch that checks the label to see if it's the one that is expected. Now consider

the following program:

To ensure that the instrumented program runs correctly when not being attacked, which of the

following functions would have to be given the same label?

7. Suppose you design software for a bank and the bank's customers may remotely log into its site

using commodity PCs. Which threat model (network-only, snooping, co-located) makes the most

sense for you to consider, when designing the bank's site? Briefly explain.

8. Suppose that x and y in the following program are symbolic. When the symbolic executor

reaches the line that prints "Hi" what will the path condition be?

/* assume x and y are both symbolic */

void foo(int x, int y) {

if (x > 5)

if (y > 7) {

printf("here\n");

} else {

if (x < 20)

printf("Hi\n");

else

printf("Bye\n");

}

}

9. Suppose that x in the following program is symbolic. When the symbolic executor reaches the

line that prints "now" what will the path condition be?

void bar(int x) {

int z;

if (x > 5)

z = 5;

else

z = 1;

if (z > 3)

printf("now\n");

}

10. Which of the following styles of fuzzer is more likely to explore paths covering every line of

code in the following program?

? Black Box

? Grammar based

? White Box

Task 2 (50 points)

Research the design of the Google Fuchsia OS (please do more than just reading Wikipedia). The code is

available here: https://fuchsia.googlesource.com.

Describe the techniques (studied in class and those that were not discussed in class) that this new OS uses

for security. For this task write a 3-page report. Include your references.

Deliverable and Grading

Upload your written report to D2L “Homework3” folder. For task1, each question is worth 5 points.