Threats - Common Software Vulnerabilities

Operating systems

Perhaps one of the things most known for vulnerabilities are operating systems. They're a pretty significant part of a computer and how a computer functions, and so they're very susceptible to these vulnerabilities. There'll be new releases that come out for operating systems to give it more functionality, but as these new items and new functionality are released, what happens is that code has vulnerabilities to it, and so then we open up holes within our operating system. Which is one reason why we want to make sure that our machine gets patched, at least with security updates.

Applications

Similarly, we also want to make sure that we have all of our applications patched on a regular basis. The problem is that these applications also open up vulnerabilities to our computer, and so we need to make sure that these are patched in a timely manner, especially when it comes to security updates.

Never use default credentials. A lot of times when we roll out new software, new operating systems or new hardware, it has default credentials on it. This is a vulnerability because it never gets changed, so make sure you change those right away.

Buffer overflow and memory injection

Another vulnerability in software is a buffer overflow. That's when a computer program is using more memory than it's allocated. So let's say this is the total amount of memory, or RAM, that's on this machine right here, and it's allocated a certain section of this for program A. And there are other programs running on here, so program B, C and D all have their memory allocation as well. Well, what happens with a buffer overflow is when program A uses more memory than it should and overwrites the sections of a different program, causing a problem with the way this computer is running. So that's the buffer overflow. And what can be leveraged with this is something like a memory injection attack, where a program is injecting more memory and using more memory than it's allocated.

Race conditions

Another vulnerability that you could find in software is called a race condition. The idea behind a race condition is you have some sort of check, and then you have a use based off of that check, and there's this time that is elapsed. That time could be a very short period of time, or it could be a very long period of time. But essentially you have something that gets checked — maybe it's permissions into a resource, perhaps it's a bank account balance — there's something that gets checked. So you've got this TOC, time elapses, and then you've got this TOU, time of use, and the difference between these two is the time of check to time of use.

So a good example of this is when you log into a Windows system, you get the permissions to these different resources. Well, if it doesn't check along the way, what could happen is you could get permission to a resource at this time of check, and then it could be taken away somewhere along this process, and then later on you still have access to it because you're still signed in and you haven't got an update to the permission level.

Malicious updates

We've already mentioned that you need to update software, whether it's the operating system or applications that are running on your machine. But there are times when there are malicious updates, when your computer pops up and says you need to install this new updated software, and it's actually some sort of trick, trying to get you to install some sort of software that looks like an update to a legitimate application but is actually malicious code.

Web-based vulnerabilities

There's also web-based vulnerabilities. These are web servers right here, and code or software gets installed on these web servers so that way it can deliver services to end users. But that's only half of the picture. A lot of the data that actually gets sent to the end user comes from a database, and there's a lot of different data that is on this database. What will happen is the user is not supposed to interact directly with that database. Instead, the user makes a request to the servers, and then the servers take the code and figure out what the request should look like and send that, via a language called SQL, back to the database. And then the database sends back to the servers the information that it needs to form the website and the data that the user is requesting, and sends it back to them. And this all happens in a very controlled environment right here.

Well, what a SQL injection, or a structured query language injection, is, is the user — instead of submitting the request, like maybe their username and password, or maybe their address or something to that effect, instead of submitting that into the fields that get sent back over to the server — they submit SQL injections, or SQL language, into those fields. It goes through the server, those commands get passed, the requests get passed to the database server, the database server executes that, and then this user ends up getting a lot more information than they should have. Maybe it lists out not just their address but all of the addresses that they put in the request for, or all of the usernames and passwords that are on the system. That could be very problematic.

The other problem is this cross-site scripting. I'm not going to get heavy into the details of it, and there's different types of cross-site scripting, but essentially the attacker would then put some sort of code on the web servers — that's one example of this — and so when somebody goes and visits the web server, they'll end up sending a lot of data directly to the attacker.

The software vulnerability life cycle

Vulnerabilities have a life cycle. They have a beginning, middle and end, and it starts out with a vulnerability getting released out there. Now why does a vulnerability get released? Well, software is constantly being developed and constantly being changed. Sometimes they need to release patches to fix something that was broken before; sometimes they need to release new features out there. So they're releasing some sort of code, not realizing that it has a vulnerability in it. So they release it, it goes out there, it gets installed on everybody's machine, and at this point in time it's called, or considered, zero day. The idea is that zero day is that the developers have had zero days to do anything about it. They probably don't even know about it. And so that's zero day right there.

Now what happens is at some point in time that vulnerability gets discovered, and it's going to go on the common vulnerabilities and exposures list, the CVE. The CVE is a big database of all of these vulnerabilities that show all of what's wrong out there. And then we go into the developers creating some sort of patch, because they're aware of it now — they create a patch and they send out a patch. Now the problem is that between this zero day and things getting patched, things are vulnerable. There is this level of vulnerability, and we call that the window of vulnerability between these two times.

The CVE database

I wanted to take a quick look into this common vulnerabilities and exposures. It's just as it sounds: this is a database that has all of the vulnerabilities and exposures that have been found and reported up until now. I'm sure there's quite a bit more that are out there, but this is what is known to this database. And they post everything, so it's all displayed. You can actually download a list of all of the exposures, and it's reported in a JSON format.

So if I go to this About and click on this Metrics, I just want to show you one of the cool things about this. This is showing you how much is part of this database, and there's thousands and thousands of records as part of this database. We have the years across the top, the quarters, and the total for each of the years. So we can see that last year — at the time of this recording — was 2023, and there were 28,961 vulnerabilities that were reported here, and 25,000 the year before that, and then 20,000, then 18,000. So it's a significant database, it's very large. But this is the common vulnerabilities and exposures.