Review materials: 1. What is a buffer? 2. How can you tell whether a buffer is in the Stack or in the Heap? 3. Buffer overflow is possible in which programming language? 4. Which worm(s) exploited buffer overflow vulnerability? 5. What are the four segments in the memory of an executable, what are stored in each segment, and what are the access rights (i.e., Read/Write/Execute) of each segment? 6. Is the following program vulnerable to buffer overflow? If yes, then explain why is it vulnerable, and how an attacker can exploit the overflow to gain access as root without knowing his password? (See the program in Slide 15, Lecture 2) 7. Show the stack content and CPU registers after function prolog of my_function. (slide 27. Lecture 2). 8. Explain the steps of the function epilog of my function. (slide 27, Lecture 2). 9. What are the two goals of an attacker for performing a code injection attack and how they can be achieved? 10. Given the following program (Slide 39, Lecture 2), show how an attacker can exploit it buffer overflow vulnerability using code injection attack. Show a sample attack input and explain how it is used to achieve the two goals. (answer follows in the slide 40, Lecture 2). 11. What are the three challenges for the attacker? How the third challenge is addressed? 12. What are the two solutions to address the first two challenges. Show with an example. 13. Explain how canary guard solution works? Do you think there is any weakness in the solution? 14. What are the three compiler enhancements? How each of them work? 15. What are the three OS enhancements? How each of them work? 16. What is the Return to libc attack and how ASLR solves it? 17. Give a few examples of secure coding practices to prevent buffer overflow. 18. How is memory allocated in Heap? Why must we free the memory (and how) when we no longer need it? 19. What are the two possible damages due to heap overflow? 20. Given the program (slide 5, Lecture 3), explain why it is vulnerable to heap overflow and why the output is showing buffer 1 and buffer 2 like the ones in slide 7 when a big input is given. Which of the two damages (question 19 ) is done due to this overflow