Question 63

Malicious code is copied to the allocated space of an already running process.

Memory injection occurs when malicious code is inserted into a running process's memory space, allowing it to execute within the context of that process. This method exploits the existing memory allocation to execute harmful actions without altering the original executable file.

A) Two processes access the same variable, allowing one to cause a privilege escalation.

This option describes a scenario related to shared memory access and potential privilege escalation but does not specifically illustrate memory injection. It focuses more on inter-process communication and security vulnerabilities rather than the direct injection of code into a process's memory.

B) A process receives an unexpected amount of data, which causes malicious code to be executed.

While this option hints at a buffer overflow or similar vulnerability, it does not precisely define memory injection. It suggests a scenario where data overflow leads to execution but lacks the specific context of injecting code into an already running process's memory.

C) Malicious code is copied to the allocated space of an already running process.

This option accurately exemplifies memory injection, as it directly describes the act of injecting malicious code into the memory space of a process that is already executing. This method allows the attacker to run the code with the privileges of the target process, making it a clear example of the concept.

D) An executable is overwritten on the disk, and malicious code runs the next time it is executed.

This option refers to a file modification attack rather than memory injection. In this case, the malicious code is stored on disk and executed upon the next launch of the program, which is distinct from injecting code into an already running process's memory.

Conclusion

Option C is definitively correct as it directly represents the concept of memory injection, where malicious code is inserted into the memory of a currently running process. The other options either describe different types of attacks or do not fulfill the criteria for memory injection, thus reinforcing the correctness of option C.