- Now in this lesson, we're gonna talk
about network, operating system and Cloud vulnerabilities.
So, let's start with a refresher because I defined network
and operating system in an earlier lesson.
Network vulnerabilities are weaknesses
within an organization's hardware
or software infrastructure.
While operating system vulnerabilities are code weaknesses,
we sometimes refer to them as bugs, which can be exploited
and/or operating system mis-configurations.
Now, there are a number of system vulnerabilities
and associated exploit categories
that impact the processor, memory, timing,
access, driver manipulation, error handling,
injection and escalation.
So, a processor vulnerability or the associated exploit
could influence processor activity.
It could exploit memory capacity,
it could influence the sequence of activities.
It could create an access path,
it could manipulate behavior,
it could expose faults, it could execute control,
or it could give access to a protected area.
So, let's dive deeper into each of these.
Memory and processor area,
there are three primary vulnerabilities
and associated exploits that we need to be familiar with.
A buffer overflow, a memory injection, and a memory leak.
A buffer overflow is overrunning the memory allocated,
so the buffer, for data input and writing the excess data
into non-allocated system memory.
Now that excess data can contain instructions
that the processor will execute.
The memory injection is inserting malicious code
into the memory of a running process.
Again, the excess data can contain instructions
that the processor will execute.
And lastly, a memory leak.
Now, memory leak is a failure of the operating system
or the application to free up dynamically requested memory.
So, what could be our impact?
Well, we could get slower, and slower,
and slower response time till ultimately
we end up with a denial of service.
And then there's a series of timing
and communication flaws, and taken together,
they're known as a race condition.
A race condition is a flaw that
produces an unexpected result when the timing
of actions impact other actions.
And there's three timing components, time of check,
time of evaluation and time of use.
Time of check or TOC is when a program
checks a state of a resource and then uses
that information to make a decision, right?
If that gets influenced, right,
well then a wrong decision might be made.
Time of evaluation is when a program relies
on the timing of events concurrently or in a specific order.
Again, in a race condition, we could,
take things out of order.
And then lastly, we have time of use.
Time of use is when the state
of a resource changes between the time of check
and the time of use, often because of a concurrent threat.
Now, all three of these are considered race conditions.
Next, we're gonna take a look at some code flaws,
injection, directory traversal,
error messages and privilege escalation.
Injection is the insertion of code or commands
by exploiting the input validation
or the processing mechanisms.
Now, an injection vulnerability is really,
really significant and can result
in some incredibly powerful attacks or exploits.
And we're gonna be talking much more
about injection later on.
Directory traversal is the ability to access files
and directories outside of the intended directory.
Error message is exposure of error message details
that can reveal system information.
Now this one is often kind of poo-pooed.
It's like, oh yeah, what are they gonna learn from that?
But as we'll see in our security and action,
you can learn a lot from an error message.
And then lastly, privilege escalation,
which is gaining elevated access
to resources that are normally protected
from an application or from a user.
And then we have a number of vulnerabilities
in our firmware and our hardware,
including outdated command injection,
default credentials, and side channel.
Now, I know we've talked
about outdated before, end of life, right?
We've talked end of life, end of support.
Here, we're talking about really outdated firmware
that is not regularly updated
to address security vulnerabilities.
So, if we don't keep up to date on our firmware,
on our hardware, on our software patches, right?
We are introducing a vulnerability.
Command injection is the injection
of malicious commands to execute code on a device.
Default credentials, we've already talked about this one.
It's a use of well-known,
often published default usernames and passwords.
And then a side channel, a side channel
is a weakness in the physical properties
of a device such as power consumption
or electromagnetic radiation that can be used
to extract sensitive information.
Next, we have some mobile vulnerabilities.
These could be outdated, sideloading,
jail-breaking or the device loss or theft.
Again, mobile device firmware and operating system
really needs to regularly be updated.
So, not regularly updating them
to address security vulnerabilities
is going to be an issue or if it's gotten too old
because we're at end of life or end of support
and we can't update it anymore when we know
that that in itself is a significant vulnerability.
Side loading is the process of installing
and running software on a mobile device from a source
other than the official app store or marketplace.
Where jail-breaking is bypassing the security restrictions
on a mobile device in order to gain greater control
and access to the device operating system and files.
And of course, the vulnerabilities associated
with a lost or stolen device if that device
had not been properly secured so anybody can get into it.
Or if any confidential data hasn't been encrypted.
And then there's the Cloud.
So, what are some inherent vulnerabilities
in the Cloud that we wanna be aware of?
Insecure APIs, shared infrastructure, lack of visibility
and potentially weak authentication.
Now, APIs, application programming interfaces
are used to provide access to and integrate Cloud resources
such as storage and processing.
So, insecure APIs provide a conduit for malicious activity.
In the Cloud environment, right,
if we are in the public Cloud,
we are in a shared infrastructure.
If we're in a community Cloud,
we're in a shared infrastructure.
It's only when we're in a private Cloud
that we're not sharing.
So, we have potential issues
in a shared infrastructure environment
or multi-tenant environment.
Could be data leakage, unauthorized access
and cross-tenant contamination.
Now, there's always concerns about lack of visibility
in the Cloud because this is such a distributed
and dynamic environment, the Cloud environment.
It makes it really challenging to gain visibility
into the security posture of Cloud resources.
And if we're accessing the Cloud with weak authentication,
generally a single factor password,
well that exposes everything
that's in that Cloud environment.
And that, my friends, brings us to a three second challenge.
Five challenge questions, three seconds each, let's do it.
Insertion of malicious code that is executed
by the processor, one, two, three,
that's gonna be an injection.
A timing flaw, one, two, three, that is a race condition.
Number three, accessing files
outside of the intended location.
One, two, three, directory traversal.
How you doing, hope you're doing great.
Number four, weakness in the physical properties
of a device, one, two, three,
that's gonna be a side channel.
And lastly, number five, bypassing security restrictions
on a mobile device, one, two, three.
And that's gonna be jail-breaking.
So, that brings us to a security in action.
This one about the yellow screen of death.
One of your web applications is generating a yellow screen
of death, a YSOD error message.
You ask the web marketing team to fix it ASAP
but they don't really respond, right?
They don't understand the prioritization
as it doesn't appear to expose any confidential information.
Why should they be concerned?
If we take a look at that error message, right?
It's exposing some information about the code
or the configuration, the program, right?
So, could it be of use, that's my question to you.
Should they be concerned
that this error message is coming up?
Go ahead, put me on pause, put down some notes.
All right, let's talk about the exposure of error messages.
Error messages can reveal implementation
and/or debugging details.
Now, exception details in this yellow screen
of death often displays lines of code
right before and after the error.
And adversaries can use this information.
This is great reconnaissance information
to identify weaknesses and to plan or craft attacks.
Every web application should have a custom error page
that doesn't reveal any application details.
And that's what we wanna tell the web marketing team
who needs to go back to the web developers
and say, "Get this fixed ASAP".
Having that conversation, well,
you know it, it's security and action.
There's a pretty big wordy cloud right here.
We talked about a lot of vulnerabilities
in network and operating system,
and firmware, and hardware, and mobile,
and in the Cloud, a lot going on here.
So take your time, go through all of these terms,
make sure that you understand them,
and you're comfortable and confident.
Now go back through the lesson, but when you're ready,
well, let's do a quiz together.