CPSC 333
Homework #5 Sample Solution
R-3.4 What is the advantage of booting from the BIOS instead of booting the operating
system directly?
Answer Attributed to Xiaoli Lin
The advantage of booting from the BIOS instead of booting the operating system directly is to split booting
stages into smaller steps in order to save memory of the CPU. When a computer is powered on or restarted,
BIOS codes in ROM are loaded into the second-stage boot loader. Then, the second-stage boot loader is
responsible for executing the rest part of booting: continue loading the OS and pass control over to the OS. In
order to avoid unauthorized executions from attackers at the starting point of a computer, setting up a BIOS
password is a good strategy of keeping the computer safe. Booting form the BIOS also provides an optimal
way for users to start the operating system from specific drives if the computer was installed in a multibooting configuration. In addition, users may also choose to start the operating system from external storage
media. Similar to the BIOS password, the second-stage boot loaders can be protected by passwords that add
to it.
R-3.7 Why would it be bad to mix the stack and heap segments of memory in the same
segment?
Answer Attributed to Patrick Simpelo
The heap deals and manages dynamic memory, meaning that the data in those addresses
are always changing, whereas the stack stores static data and is more for retaining that
memory. The reason for the stack growing downwards is because it needs to add data to
memory address and the same goes for the heap, which grows upwards. If we were to mix
these segments together, then both the heap and stack wouldn’t be able to track their
proper memory addresses because memory addresses are usually contiguous and relate to
adjacent/near addressed. Thus, since both the stack and heap need room to grow, they are
put on opposite sides (above the BSS segment) and grow towards each other.
Unfortunately, this raises different issue of the segments colliding in the middle.
R-3.11 What is the purpose of salting passwords?
Answer Attributed to Xuan Ho
Password salting is a technique that uses random bits as part of the input to a hash function
or encryption algorithm in order to increase the randomness in the output. In the case of
password authentication, salt would be introduced by associating a random number with
each userid. Then, rather than comparing the hash of an entered password with a stored
hash of a password, the system compares the hash of an entered password and the salt for
the associated userid with a sorted has of the password and salt.
Answer Attributed to Daniel Jordan
Salting passwords adds an element of uniqueness to storing passwords. Without salt, a
user’s password is passed through a hash function, and stored in a database. This means
users with the same password will have identical hashes. An attacker could use a
precompiled table of common passwords and their hash values, in an attempt to recover
hashed passwords. By using a unique salt value (a user ID for instance), duplicate passwords
will still contain a unique hash. This means that even if an attacker were to break the salt
and hash for a particular password, they would only have that single user’s password, and
not the users using the same password.
R-3.13 Eva has just discovered and decrypted the file that associates each userid with its 32bit random salt value, and she has also discovered and decrypted the password file, which
contains the salted-and-hashed passwords for the 100 people in her building. If she has a
dictionary of 500,000 words and she is confident all 100 people have passwords from his
dictionary, what is the size of her search space for performing a dictionary attack on their
passwords?
Answer Attributed to Tory Kepler
Since Eve knows each users salt value and that all users have password that is in the
500,000 word dictionary, she need only compare each hash of the salt + dictionary word
with the actual hash for each person. Thus:
Search space = 500,000 x 100 = 50,000,000
R-3.20 Dr. Blahbah claims that buffer overflow attacks via stack smashing are made possible
by the fact that stacks grow downwards (towards smaller addresses) on most popular
modern architectures. Therefore, future architectures should ensure that the stack grows
upwards; this would provide a good defense against buffer overflow. Do you agree or
disagree? Why?
Answer Attributed to Xiaoli Lin
I disagree with Dr. Blahbah’s point of view. The occupation of a buffer overflow does not
depend on the downwards or upwards growing of stacks because attackers can simply
guess the start location with bottom to top or top to bottom architecture. Future
architectures should make the address space hard to predict so that attackers will not easily
overwrite the return address to point to their malicious code for execution. Using a random
canary is one solution to detect stack smashing by placing it before the return address to
check if overwritten exists. More important, to prevent stack-based buffer overflow,
programmers should consider secure knowledge while practicing coding skills.