Data execution prevention is a feature in most operating systems intended to protect against which type
of attack?
A.
Cross-site scripting
B.
Buffer overflow
C.
Header manipulation
D.
SQL injection
Explanation:
Data Execution Prevention (DEP) is a security feature included in modern operating systems. It marks
areas of memory as either “executable” or “nonexecutable”, and allows only data in an “executable” area
to be run by programs, services, device drivers, etc. It is known to be available in Linux, OS X, Microsoft
Windows, iOS and Android operating systems.
DEP protects against some program errors, and helps prevent certain malicious exploits, especially
attacks that store executable instructions in a data area via a buffer overflow.A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data
storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data,
the extra information – which has to go somewhere – can overflow into adjacent buffers, corrupting or
overwriting the valid data held in them. Although it may occur accidentally through programming error,
buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow
attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new
instructions to the attacked computer that could, for example, damage the user’s files, change data, or
disclose confidential information. Buffer overflow attacks are said to have arisen because the C
programming language supplied the framework, and poor programming practices supplied the
vulnerability.
Incorrect Answers:
A: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web
applications. XSS enables attackers to inject client-side script into Web pages viewed by other users.
Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems
on which they rely. Exploiting one of these, attackers fold malicious content into the content being
delivered from the compromised site. When the resulting combined content arrives at the client-side web
browser, it has all been delivered from the trusted source, and thus operates under the permissions
granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain
elevated access-privileges to sensitive page content, session cookies, and a variety of other information
maintained by the browser on behalf of the user. Data Execution Prevention (DEP) is not used to prevent
against this type of attack.
C: A header manipulation attack uses other methods (hijacking, cross-site forgery, and so forth) to change
values in HTTP headers and falsify access. When used with XSRF, the attacker can even change a user’s
cookie. Internet Explorer 8 and above include InPrivate Filtering to help prevent some of this. By default,
your browser sends information to sites as they need it—think of requesting a map from a site; it needs
to know your location in order to give directions. With InPrivate Filtering, you can configure the browser
not to share information that can be captured and manipulated. Data Execution Prevention (DEP) is not
used to prevent against this type of attack.
D: SQL injection is a code injection technique, used to attack data-driven applications, in which malicious
SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the
attacker). SQL injection must exploit a security vulnerability in an application’s software, for example,
when user input is either incorrectly filtered for string literal escape characters embedded in SQLstatements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known
as an attack vector for websites but can be used to attack any type of SQL database. Data Execution
Prevention (DEP) is not used to prevent against this type of attack.http://searchsecurity.techtarget.com/definition/buffer-overflow
http://en.wikipedia.org/wiki/Cross-site_scripting
Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, p. 340
http://en.wikipedia.org/wiki/SQL_injection