GSEC · Question #34
You are reviewing a packet capture file from your network intrusion detection system. In the packet stream, you come across a long series of "no operation" (NOP) commands. In addition to the NOP comma
The correct answer is C. Controls against time of check/time of use attacks. A NOP sled followed by a malicious payload is an indicator of a memory injection exploit; the preventative measure targets the race condition timing flaw that allows such code to execute.
Question
You are reviewing a packet capture file from your network intrusion detection system. In the packet stream, you come across a long series of "no operation" (NOP) commands. In addition to the NOP commands, there appears to be a malicious payload. Of the following, which is the most appropriate preventative measure for this type of attack?
Options
- ALimits on the number of failed logins
- BBoundary checks on program inputs
- CControls against time of check/time of use attacks
- DRestrictions on file permissions
How the community answered
(43 responses)- A12% (5)
- B7% (3)
- C79% (34)
- D2% (1)
Why each option
A NOP sled followed by a malicious payload is an indicator of a memory injection exploit; the preventative measure targets the race condition timing flaw that allows such code to execute.
Limits on failed logins mitigate brute-force authentication attacks and have no effect on in-memory code injection techniques such as NOP sled execution.
Boundary checks on program inputs directly prevent buffer overflows but do not address the race condition timing window that allows injected payloads to run after a check has already passed.
Controls against time of check/time of use (TOCTOU) attacks address race conditions where an attacker manipulates a resource between the moment it is verified and the moment it is used - a timing window that NOP sleds exploit to redirect execution flow to injected shellcode before security checks complete.
File permission restrictions control access to files on disk but cannot prevent in-memory code injection or NOP sled execution within an already-running process.
Concept tested: TOCTOU attack prevention and NOP sled exploit technique
Source: https://owasp.org/www-community/vulnerabilities/Time_of_check_time_of_use
Topics
Community Discussion
No community discussion yet for this question.