At a retailer, a program copies more data into a fixed buffer than that buffer can hold, and the process then runs attacker-controlled instructions. Which attack is this?
Select an answer to reveal the explanation.
Short Explanation
Pour a gallon into a pint glass and the spill can knock the next switch. You are looking at a buffer overflow that writes past the buffer and then runs attacker-controlled instructions. The trap is naming ransomware, a beacon, or a phish when the story is memory corruption.
Full Explanation
A buffer overflow copies more data into a fixed memory buffer than the buffer can hold. The extra bytes overwrite adjacent memory, and in this case the process then executes instructions the attacker controlled. That is the endpoint attack described on the register host. The attack is "A buffer overflow that writes past a fixed buffer and then executes attacker-controlled instructions". "Ransomware that encrypts store files and then demands payment, with no memory corruption in the case" would encrypt files and demand payment, and the scenario describes neither encryption nor a demand. "A command-and-control beacon that calls home on a timer, with no memory corruption in the case" is a later callback for tasking, and this story has no beacon and does have memory corruption. "A phishing lure that tricks a clerk, with no exploit of a program buffer on the register host" is social engineering without an exploit, and here a program buffer was overrun and instructions ran. Exam caveat: a buffer overflow is the memory-corruption bug itself, and it can be the foothold that later leads to other stages without those stages being this step. Operational check: capture the faulting process, the input that exceeded the buffer, and a memory or crash record showing execution at the attacker-controlled address before you label a later ransom or callback.