nerdexam
GIAC

GCIA · Question #57

An attacker changes the address of a sub-routine in such a manner that it begins to point to the address of the malicious code. As a result, when the function has been exited, the application can be…

The correct answer is B. SmashGuard. The image depicts a stack-based return address overwrite attack where malicious code hijacks the control flow after a function returns. SmashGuard is a hardware-based countermeasure specifically designed to protect the return address on the stack from being overwritten.

Network Forensics, Protocol Insecurity & Evasion Techniques

Question

An attacker changes the address of a sub-routine in such a manner that it begins to point to the address of the malicious code. As a result, when the function has been exited, the application can be forced to shift to the malicious code. The image given below explains this phenomenon:

Which of the following tools can be used as a countermeasure to such an attack?

Options

  • AObiwan
  • BSmashGuard
  • CKismet
  • DAbsinthe

How the community answered

(44 responses)
  • A
    11% (5)
  • B
    82% (36)
  • C
    5% (2)
  • D
    2% (1)

Why each option

The image depicts a stack-based return address overwrite attack where malicious code hijacks the control flow after a function returns. SmashGuard is a hardware-based countermeasure specifically designed to protect the return address on the stack from being overwritten.

AObiwan

Obiwan is a static analysis tool focused on detecting off-by-one errors in source code, not a runtime countermeasure against return address hijacking.

BSmashGuardCorrect

SmashGuard is a processor-level protection mechanism that defends against stack-smashing attacks by saving a copy of the return address in a separate hardware register and comparing it before the function returns. If the return address has been tampered with - as described in the question - execution is halted before control transfers to malicious code. This directly counters the return address overwrite technique shown.

CKismet

Kismet is a wireless network intrusion detection and packet sniffing tool with no relevance to stack-based memory protection.

DAbsinthe

Absinthe is an automated SQL injection exploitation tool used offensively against databases, not a memory protection countermeasure.

Concept tested: Stack smashing protection and return address defense

Source: https://csrc.nist.gov/publications/detail/sp/800-123/final

Topics

#buffer overflow#stack smashing#return address hijacking#SmashGuard

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIA Practice