CS4630 Spring 2021 exam

Answer each of the following questions. This exam is open-book and open-notes, but you may use only resources that were created before this exam was released (at 9pm eastern time on 12 May 2021). You may not collaborate with other students.

Please show your work for questions in the comments field were applicable so we are able to give you partial credit.

If you think a question is ambiguous or unclear, please make your best guess about what was meant and explain what you did in the comments field for the question. We are unlikely to be able to answer your inquiries during the exam time.

Some viruses infect executables by compressing the original executable and creating a wrapper that that runs the virus code, then decompresses and runs the executable.

Question 1 (4 points) (see above)

Which of the following antivirus techniques likely motivated this virus design? Select all that apply.

scanners that only read the beginning and end of an executable file for efficiency
pattern-matching based malware scanning
checking the metadata of executables for changes to find malware
looking for changes to "sacrificial goat" executables that are placed on the filesystem in a place where virus-like malware is likely to infect it but are not actually useful executables

Question 4 (4 points)

Viruses that append their virus code to an executable can often be detected based on changes made to the list of segments in an executable's headers.

Consider the following executable headers:

a.out:    file format elf64-x86-64
a.out
architecture: i386:x86-64, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x0000000000401c10

Program Header:
    LOAD off    0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**12
         filesz 0x0000000000000518 memsz 0x0000000000000518 flags r--
    LOAD off    0x0000000000001000 vaddr 0x0000000000401000 paddr 0x0000000000401000 align 2**12
         filesz 0x000000000009375d memsz 0x000000000009375d flags r-x
    LOAD off    0x0000000000095000 vaddr 0x0000000000495000 paddr 0x0000000000495000 align 2**12
         filesz 0x0000000000026650 memsz 0x0000000000026650 flags r--
    LOAD off    0x00000000000bc0c0 vaddr 0x00000000004bd0c0 paddr 0x00000000004bd0c0 align 2**12
         filesz 0x0000000000005170 memsz 0x00000000000068c0 flags rw-
    NOTE off    0x0000000000000270 vaddr 0x0000000000400270 paddr 0x0000000000400270 align 2**3
         filesz 0x0000000000000020 memsz 0x0000000000000020 flags r--
    NOTE off    0x0000000000000290 vaddr 0x0000000000400290 paddr 0x0000000000400290 align 2**2
         filesz 0x0000000000000044 memsz 0x0000000000000044 flags r--
     TLS off    0x00000000000bc0c0 vaddr 0x00000000004bd0c0 paddr 0x00000000004bd0c0 align 2**3
         filesz 0x0000000000000020 memsz 0x0000000000000060 flags r--
0x6474e553 off    0x0000000000000270 vaddr 0x0000000000400270 paddr 0x0000000000400270 align 2**3
         filesz 0x0000000000000020 memsz 0x0000000000000020 flags r--
   STACK off    0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
         filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
   RELRO off    0x00000000000bc0c0 vaddr 0x00000000004bd0c0 paddr 0x00000000004bd0c0 align 2**0
         filesz 0x0000000000002f40 memsz 0x0000000000002f40 flags r--

Briefly describe what would likely be changed in the headers shown above if a virus appended its code to this end of this executable. Assume that the appended viruses code is larger than 1 page (4096 bytes) in size.

Answer:

Question 5 (4 points)

To evade pattern-based detection and analysis, malware frequently "encrypts" most of its code and includes a randomized decryption routine that decrypts and runs the code.

A frequently proposed solution for antimalware software or analysts to obtain the decrypted code is to run the malware in an emulator, and stop when the malware starts runnning machine code that it wrote while running. Then, one would examine the memory managed by the emulator for the decrypted code. Briefly explain a way that malware could defeat this automated scheme.

Answer:

Some self-replicating malware tries to evade signature based detection by performing a machine code to machine code transformation as part of its replication process. One possible transformation is to introduce additional operations that have no useful effects in between instructions as part of this transformation.

Question 6 (4 points) (see above)

One idea to detect this transformation is to ignore nop instructions and instructions that do not change any values in memory or registers (e.g. add $0, %rax, jmp foo; foo:) when doing pattern matching. Give an example of how malware could use this strategy of inserting additional useless instructions between its instructions but evade this countermeasure.

Answer:

Question 7 (4 points) (see above)

To implement this transformation, the malware must make some adjustments to deal with jumps and calls within the malware code. Suppose a jump instruction is encoded using a relative offset. Which of the following information would alone be sufficient to the malware to produce a correct jump instruction in the new machine code? Select all that apply.

the difference between the location of the jump's target in the old machine code and the new machine code
both the difference between the location of the jump in the old machine code and its location in the new machine code and the difference between the location of the jump's target in the old machine code and the new machine code
the difference between the location of the jump's target in the old machine code and the location of the jump in the old machine code
the difference between the location of the jump's target in the new machine code and the location of the jump in the new machine code

Question 8 (5 points)

Which of the following techniques are likely to make it more difficult to set breakpoints and, when those breakpoints are reached, get a useful call stack trace of some malware in a debugger? Select all that apply.

encrypting constant strings and values
copying values between variables one bit a time, using an if statement to determine whether to write 0 or 1 in each location
malware having code that reads its machine code and verifies that it hashes to a specific value
converting a function that uses if statements and other flow control to instead be composed of a loop around a switch statement, where rather than an if statement jumping to the code for the "then" or "else" part, it will set the control variable for the switch and return to the top of the loop
converting the program's code to a code for a custom virtual machine and including an emulator for that machine and the converted code

Question 9 (5 points)

Consider a dynamic taint tracking scheme that executes a program by annotating each value in a running program with a flag about whether it is "tainted". When a tainted value is used in arithmetic to compute another another value, the other value is marked as tainted. Which of the following techniques are likely make this kind of dynamic taint tracking scheme ineffective? Select all that apply.

encrypting constant strings and values
copying values between variables one bit a time, using an if statement to determine whether to write 0 or 1 in each location
malware having code that reads its machine code and verifies that it hashes to a specific value
converting a function that uses if statements and other flow control to instead be composed of a loop around a switch statement, where rather than an if statement jumping to the code for the "then" or "else" part, it will set the control variable for the switch and return to the top of the loop
converting the program's code to a code for a custom virtual machine and including an emulator for that machine and the converted code

Question 10 (4 points)

What is the difference between a sandbox and a virtual machine?

A sandbox runs everything as the same user, but a virtual machine runs everything as an entirely new user
A sandbox can only perform privilege separation on an application, but cannot prevent it from accessing files which a virtual machine can
A sandbox limits how the system can talk to the OS, but a virtual machine creates an entirely new OS
A sandbox prevents an application from making any changes to the system, but a virtual box allows for changes via file transfer.

Suppose we wanted to use sandboxing to protect against vulnerabilities in a video calling application.

Question 11 (4 points) (see above)

What would be true about attempting to do this by confining the entire application using chroot? Select all that apply.

we would need to identify the location of the video calling application's configuration files for this to be useful
if the video calling application supports sharing files with other users, then it would be difficult to support this functionality in the confined environment
this technique would be likely keep the video calling application from sharing the content of other windows with users

Question 12 (4 points) (see above)

If one wanted to use privilege separation for this task, what is a part of the video calling application that would be a good candidate for performing privilege separation?

Answer:

Question 13 (4 points)

How does AFL-tmin know its minimized test case triggers the same bug as the original test case?

AFL checks if the backtrace of the crash is the same
AFL checks if the crash occured on the same line of c code
AFL checks if the values on the stack are the same
AFL checks if the input values are used by the code that crashes
AFL checks if the program executes the same branches to produce a crash

Question 14 (4 points)

Which of the following are allowed under Rust's ownership rules? Assume only built-in references are used, not special reference classes that implement different policies like Rc or RefCell. Select all that apply.

making a hashmap whose keys and values are strings, and having a function that modifies that hashmap after being passed a string to insert into the hashmap and mutable reference to the hashmap as arguments
constructing a binary tree composed of objects of a Node struct type, where each Node has a mutable reference that can be used to read or write its left and right child
constructing a binary tree composed of objects of a Node struct type, where each Node has a mutable reference that can be used to read or write its left and right child and its parent
putting a reference that can be used by another core to read a local progress variable managed by a search function in a global variable whenever the search function is running (and setting the reference to a null/placeholder value when search function completes)

Question 15 (5 points)

Some bounds-checking schemes use a lookup table that allows code to use the address of any byte of an object to determine the beginning and end and size of an object. Which of the following are true about these schemes? Select all that apply.

these schemes will stop code that overflows a buffer in one object to overwrite a pointer near the beginning of the next object in memory
these schemes will stop code that overflows a buffer in a struct from overwriting a pointer later on in the struct
this approach requires allocating a "red zone" of unused space between objects
these schemes require changes the memory allocator (malloc, new, etc.)
these schemes require changing how pointers are represented (such as by replacing pointers with a struct with additional information or encoding extra information in the high bits of pointers)

Question 16 (4 points)

Which of the following patterns would match the machine code for an x86-64 return? Select all that apply.

c3
[cC]3
\xc3
\xc\x3

Question 17 (4 points)

Which of the following statements are true about using static analysis to find potential security bugs (such as use-after-free or a buffer overflow) in a function F()?

the analysis may report potential bugs that are not actually possible, no matter how F() is run
if F()'s behavior depends on other functions it calls, then the analysis requires access to the code for those functions to produce any results
if the function has arguments that it uses, the static analysis will need to simulate the function for each possible value of those arguments
if the function has a potentially infinite loop, the analysis will not be able to find all potential bugs

CS4630 Spring 2021 exam

final exam