CS 161 Computer Security Spring 2010 Paxson Wagner MT1 P RINT your name last first S IGN your name P RINT your class account login cs161Your TA s name Your section time Name of the person sitting to your left Name of the person sitting to your right You may consult one sheet of paper double sided of notes You may not consult other notes textbooks etc Calculators and computers are not permitted Please write your answers in the spaces provided in the test We will not grade anything on the back of an exam page unless we are clearly told on the front of the page to look there You have 80 minutes There are 6 questions of varying credit 100 points total The questions are of varying difficulty so avoid spending too long on any one question Do not turn this page until your instructor tells you to do so Problem 1 Problem 2 Problem 3 Problem 4 CS 161 Spring 2010 MT1 Problem 5 Problem 6 Total 1 Problem 1 True or false 14 points Circle T RUE or FALSE Do not justify your answers on this problem a T RUE or FALSE SQL injection vulnerabilities can be avoided by applying the following algorithm to every untrusted input replace every instance of with amp replace every instance of with lt replace every instance of with gt and replace every instance of with quot b T RUE or FALSE The same origin policy generally allows JavaScript from berkeley edu to read cookies associated with berkeley edu c T RUE or FALSE The same origin policy generally allows JavaScript from berkeley edu to read cookies associated with stanford edu d T RUE or FALSE A benefit of privilege separation is that it can provide an opportunity to reduce the size of the TCB e T RUE or FALSE If we ensure that the attacker does not have permission to read the value of session cookies stored by the victim s browser session fixation attacks become impossible f T RUE or FALSE It is easier to passively eavesdrop on UDP traffic than on TCP traffic g T RUE or FALSE Ingress filtering refers to carefully escaping meta characters in URLs CS 161 Spring 2010 MT1 2 Problem 2 Short answer 22 points In each part below circle the best answer then briefly justify your answer in one line or less a BankOBits is a local bank that offers its customers access to a number of conveniently located ATMs Normally when a customer inserts his her ATM card into a BankOBits ATM the ATM will contact the BankOBits central server to validate the ATM card inserted into it and check that the corresponding account has sufficient funds before allowing the user to withdraw money However if the server does not respond the network connection is down or something else goes wrong with this query the BankOBits ATM will assume all is well allow the customer to withdraw up to 300 keep a record of the transaction and upload that information to the BankOBits server whenever connectivity is restored As a result of this design decision a gang of criminals are able to steal from the bank by cutting the network connection on BankOBits ATMs and withdrawing 300 from them using a fake ATM card In this story which security principle was violated Circle one the best answer and briefly explain i Least privilege ii Fail safe defaults iii Separation of responsibilities iv Human factors matter Justification b David Wagner once heard about a kiosk at one airport that let you access the web for a fee To use the kiosk you had to enter your credit card information at a welcome screen before the kiosk would give you access to a web browser However some hacker discovered that if you press F1 to invoke the help screen the Windows help subsystem would pop up a window with generic help information about the login screen The help text happened to contain a link to an external web site with more help information and if you click on that link the kiosk would open the Internet Explorer web browser to display that web page At that point one could change the URL in the Internet Explorer address bar and gain full access to the web without paying In this story which security principle was violated Circle one the best answer and briefly explain i Fail safe defaults ii Separation of responsibilities iii Complete mediation iv Psychological acceptability Justification continued on next page CS 161 Spring 2010 MT1 3 c The Fortune 500 company FooCorp has an internal web application that its employees can use to fill out travel vouchers Unfortunately FooCorp s system administrators have recently discovered that the voucher web application has cross site request forgery CSRF vulnerabilities FooCorp has a firewall that blocks all inbound connections from the external world to FooCorp s internal network but allows all web connections initiated from machines on FooCorp s internal network Does FooCorp s firewall prevent exploitation of the CSRF vulnerabilities in its travel voucher application Circle yes or no then briefly explain in one line or less i Yes ii No Justification d Suppose we are building a web application that asks the user for their email address and stores it in a variable m We want to invoke the shell to send an email message to the email address m like this void sendemail char m char cmd 1024 snprintf cmd sizeof cmd mail s m f popen cmd w However before we invoke sendemail m we want to ensure that m is safe to use with this code Which of the following would be the best way to do that Circle the best safest answer a Check that m does not contain any of the following characters b Remove all instances of the following characters from m c Check that m starts with a letter a z or A Z and is composed solely of the following characters abc zABC Z0123 9 d None of the above This code cannot be made safe no matter what checks you do on m Explain why briefly one line or less CS 161 Spring 2010 MT1 4 Problem 3 Printer discovery 16 points A consortium of printer vendors have come up with a great new protocol to help users automatically discover the set of printers on their local network In this protocol when the user wants to print something the user s computer automatically broadcasts a Printer Discovery packet A Printer Discovery packet is a UDP packet whose destination address is the broadcast address and whose source and destination port is 56184 Because this is a broadcast packet every host on the local network will receive it Printers constantly listen for Printer Discovery packets Any time that they receive one they immediately respond with a Printer Announcement packet A Printer Announcement packet is a UDP
View Full Document
Unlocking...