Week 8 — Midterm Exam Week: Quiz-1¶

Integrity. A message authentication code (HMAC) or a digital signature; TLS in transit (with chain validation and hostname verification).

T, I, D. A data flow has no identity of its own; spoofing applies to assets and processes.

The IVP independently verifies that the data is consistent. If a faulty TP is certified, the enforcement rules cannot see it (the transaction looks authorized); the IVP is what catches the inconsistency.

The same key and nonce produce the same keystream; XOR-ing two ciphertexts yields the XOR of the two plaintexts, and in addition the authentication key can be recovered and forged tags can be produced.

SHA-256 is fast; an attacker can try billions of guesses per second. Argon2id is deliberately slow and memory-hard; combined with a salt, it makes every guess expensive.

It stops a sequential stack overflow that reaches the return address, by terminating the program. It does not stop corruption of variables that sit before the canary, heap overflows, or a leaked canary value.

Shrinking, optimisation, obfuscation (renaming), preverification. None of them hide strings.

Instead of crashing immediately at the moment of detection, delivering the response at a point removed in time and in code (e.g., wiping the secret and returning a decoy). Crashing immediately shows the attacker exactly which check was triggered.

void kaydet(const char *ad) {
    char tampon[32];
    sprintf(tampon, "kullanici=%s", ad);
    syslog(LOG_INFO, tampon);
}

Two bugs: sprintf writes without a bound (overflow, STR31-C; snprintf should be used instead), and syslog is given a variable string as its format argument (format string vulnerability, FIO30-C; syslog(LOG_INFO, "%s", tampon) should be used instead).

char parola[64];
oku(parola, sizeof parola);
dogrula(parola);
memset(parola, 0, sizeof parola);
return;

Because the array is never read after the memset, the compiler is allowed to remove that line entirely (MSC06-C, CWE-14). explicit_bzero / SecureZeroMemory should be used instead.

String sql = "SELECT * FROM notlar WHERE ogrenci = '" + no + "'";
ResultSet rs = st.executeQuery(sql);

SQL injection (CWE-89, IDS00-J). A PreparedStatement with a ? parameter should be used.

EVP_DecryptUpdate(ctx, acik, &n, sifreli, sifreli_n);
kullan(acik, n);
EVP_DecryptFinal_ex(ctx, acik + n, &m);

The plaintext is used before the tag is verified (before Final), and the return value of Final is never checked. The tag should be checked first, the plaintext used only if Final succeeds, and wiped if it fails.

if (istek.contains("..")) throw new SecurityException();
return Files.readAllBytes(kok.resolve(istek));

A raw-string check can be bypassed (absolute paths, symbolic links, encoded forms). The path must first be canonicalized (normalize, toRealPath) and then checked to be inside the root (FIO16-J).

try { pinDenetle(zincir); }
catch (KeyStoreException e) { e.printStackTrace(); }

Fail-open: the keystore error is swallowed and the connection is accepted. Uncertainty should lead to rejection (the exception should be rethrown as a CertificateException).

A key extracted from a single copy affects every user (a violation of "compromising one instance must not affect the others"); it can be read out of the bytecode/binary. Recommendation: a key generated or derived on the server per user/device, device and version binding, wrapping, white-box if necessary; the key is never embedded in the code.

No obfuscation, symbols and log strings exposed, the debuggable flag enabled (a debugger can attach), possibly leftover sanitizer or debug code. The release build's protections (checksec) and the removal of logging must be verified.

R (repudiation). A tamper-resistant audit log (HMAC chain, key evolution), signed transaction records, records sent to the server immediately, timestamps.

Zip Slip (../ in file names): canonicalize every entry's target path and check that it stays inside the root; size and file-count limits (decompression bombs); reject symbolic links; validate length fields, and fuzz the function.

Not knowing which version of Log4j (including copies embedded inside other libraries) was present in which system. An SBOM (CycloneDX/SPDX) produced on every release and continuously monitored, plus an SCA tool.

An attacker who flips the one comparison, or who makes the check function always return "clean," bypasses all of it. Check results should feed into the data used by a later computation (e.g., key derivation), be carried as opaque values, checks should be spread across multiple points and cross-check each other, and the response should be delayed.