CyberCertPrepMobile Security FundamentalsMobile OS ArchitectureEASYFree question
What is the purpose of 'Address Space Layout Randomization' (ASLR) on Android and iOS?
- A.ASLR randomizes the encryption keys used for file-based encryption on each boot
- B.ASLR is an Android feature that randomizes app UIDs to prevent fingerprinting
- C.ASLR randomizes the memory addresses of the stack, heap, and loaded libraries each time a process starts, forcing attackers to guess or leak addresses before constructing reliable exploits
- D.ASLR is a feature that randomizes which CPU core an app runs on to prevent side-channel attacks
Why C is correct
ASLR is enabled on both Android and iOS. Without ASLR, memory corruption exploits (buffer overflows, use-after-free) can jump to known addresses. With ASLR, attackers must first find an information disclosure vulnerability to leak a runtime address before they can construct reliable ROP/JOP chains. ASLR is most effective combined with W^X (write xor execute).
Know someone studying for Mobile Security Fundamentals? Send them this one.