QuestionQ216

VerifiedSecurity Operations

The security operations center (SOC) has received credible intelligence that a threat actor plans to attack using multiple variants of a destructive virus. After acquiring a sample set of the virus variants and reverse engineering them to understand their operation, a shared characteristic was identified: all variants are coded to write to one specific memory location.

It is determined that this virus poses no threat to the organization because it had the foresight to enable which feature on all endpoints?

Explanation

Address Space Layout Randomization (ASLR) randomizes the virtual-memory locations of executable images and allocations, making a fixed, attacker-specified memory address unreliable. Malware that depends on writing to one particular address therefore cannot consistently reach its intended target. Microsoft documents that ASLR enables virtual-address allocation randomization affecting heaps, stacks, and other operating-system allocations.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!