Your company decides to start the business of selling toys online and shipping globally. A team in-house is in charge of developing an E-Commerce system that supports the new business. The testing team was conducting dynamic application security testing (DAST) and activated the Calculator app, one of the Windows accessories, on one of the web servers through an input field in an HTML form. This test demonstrated a successful attempt of intrusion. Which of the following is least feasible to prevent the attack?
A. Apply limit of the input length.
B. Enable Data Execution Prevention (DEP)
C. Enable Address Space Layout Randomization (ASLR)
D. Conduct Time-of-check to time-of-use (TOC/TOU) check

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is D. Conduct Time-of-check to time-of-use (TOC/TOU) check.

The demonstrated attack is a buffer overflow attack. A buffer is a data storage, typically in memory or RAM. Buffer is a general term. It varies in terms of data structure and usage. Heap and Stack are buffers for data storage.

Buffer overflow is the situation that the number of data units exceeds the size of the buffer. It will cause exceptions so that the operating system will terminate the process (application) or return the execution to a certain memory address.

A heap is a segment of memory for the process (application in execution) to use, predefined or dynamically.

A stack is the segment of memory used specifically to hand function calls. A process can have multiple threads for processing. Each thread has its own stack. A stack is like the trail of bread crumb, a citation from fairy tales and pop culture: “Alice in Wonderland.”

When a function (a unit of code) invokes another function, the source function has to “memorize” the location (address) it is, then jumps to another function for execution. After the function being called finished, the original location was retrieved and the execution will return to the original function.

The calling function “pushes” the “address” into a stack to “memorize” the location to return. The called or invoked function “pop” out the location to return to the original address.

Stack overflow is more dangerous because attackers can manipulate the return address in the stack to have the malicious code executed. It’s common for attackers to inject malicious code from the regular user interface.

It’s crucial to validate the user inputs and enable DEP and ASLR to prevent malicious code from being executed and raise the bar to inject malicious code.