In this section of the course, we are going
to discuss vulnerabilities and attacks.
The vulnerabilities and attacks section
of the course focuses on domain three, security engineering,
as well as domain four, security operations,
specifically objectives 3.4 and 4.2.
Objective 3.4 states that given a scenario, you must be able
to implement hardware security technologies and techniques.
Objective 4.2 states that given a scenario,
you must be able to analyze vulnerabilities and attacks
and recommend solutions to reduce the attack surface.
Understanding vulnerabilities and attacks is crucial
in safeguarding enterprise networks and systems.
Enterprise vulnerabilities and weaknesses arise
from how software is built,
how systems are configured, and even how access is managed.
Attackers often work to exploit these vulnerabilities
by injecting harmful code, manipulating system memory,
or even targeting physical hardware.
Staying ahead of threat actors requires a proactive approach
to identifying and addressing vulnerabilities
before they can be exploited.
As we go through this section,
we will cover many topics related to vulnerabilities
and attacks, including injection vulnerabilities,
memory-related vulnerabilities,
configuration vulnerabilities,
authorization vulnerabilities, malicious code attacks,
hardware and firmware attacks, memory-based attacks,
and electromagnetic attacks.
First, we will look at injection vulnerabilities.
Injection vulnerabilities occur when an attacker is able
to inject malicious code into a system
through an input field or other interface.
Malicious code injection can lead to unintended
or harmful execution of commands.
Specific injection vulnerabilities
include command injection, code injection,
cross-site scripting, cross-site request forgery,
server-side request forgery, and deserialization.
Command injection occurs
when an attacker exploits vulnerabilities in a system
to execute arbitrary commands
on the host operating system.
Command injection may result
in attackers getting unauthorized network access,
manipulating system files,
or taking control of the entire system.
Code injection involves inserting malicious code
into a vulnerable application,
which is then executed by that application.
Code injection can then lead to data breaches,
unauthorized access, and the execution
of unintended actions within the application,
potentially compromising the entire system's integrity.
Injection attacks can also take various forms,
including structured query language or SQL injection.
In an SQL injection attack,
an attacker inserts malicious SQL commands
into a database query
for the purpose of manipulating the database
to execute unauthorized actions,
altering or deleting records,
or even gaining administrative control over the database.
Cross-site scripting is another type of attack
that can occur as a result of injection vulnerabilities.
In a cross-site scripting attack,
an attacker injects malicious scripts into webpages.
These scripts can steal sensitive information,
hijack accounts, redirect users to malicious websites,
or manipulate the webpage content.
Cross-site request forgery attacks involve manipulating
a user into performing actions they did not intend.
Cross-site request forgery attacks abuse the trust
between a client and a server.
A server-side request forgery allows an attacker
to force a server to make unauthorized requests
to internal systems or external resources.
A server-side request forgery abuses the trust
between a front-end server and a back-end
or internal resource.
Deserialization attacks occur
when an attacker injects malicious data
into an application that processes the data
by converting it from a serialized format
back into its original object form.
This is called deserialization.
During deserialization,
the application may inadvertently execute harmful code
embedded in the data leading to remote code execution,
privilege escalation, or data corruption.
Next, we'll explore memory-related vulnerabilities.
Memory-related vulnerabilities refer to flaws
in how an application handles memory,
potentially allowing attackers
to execute malicious code, cause crashes,
or leak sensitive information.
Memory-related vulnerabilities include deprecated functions,
unsafe memory utilization, overflows, race conditions,
and time of check to time of use vulnerabilities.
Deprecated functions are older, insecure functions
that are still in use.
The use of deprecated functions can lead
to unsafe memory utilization
and exposure of a system
to vulnerabilities like buffer overflows.
In a buffer overflow attack,
an attacker overflows a memory buffer
to overwrite adjacent memory.
An overflow attack can lead to the execution
of arbitrary code, allowing the attacker to take control
of the system, corrupt data,
or crash the application entirely.
Overflows and unsafe memory usage often create opportunities
for race conditions.
A race condition occurs when the timing
of operations is manipulated to exploit the system.
Specifically, a race condition can occur
when two processes attempt
to modify the same data concurrently leading
to unpredictable results,
such as a financial transaction being processed twice.
A specific type of race condition is a time of check
to time of use condition.
To exploit a time of check to time of use vulnerability,
an attacker may change the system's state
between the time the system checks a condition
and the time it uses the result,
leading to unexpected behavior.
After that, we will look at configuration vulnerabilities.
Configuration vulnerabilities occur when systems,
applications, or networks are improperly configured.
Configuration vulnerabilities
include directory service misconfiguration,
unsecure configuration, embedded secrets,
outdated or unpatched software and libraries,
and end-of-life software.
Directory service misconfigurations are improper setup
or management of directory services,
such as active directory.
Directory service misconfigurations can lead
to security vulnerabilities and unauthorized access.
Unsecure configurations are improperly set system settings
or defaults that can leave a system vulnerable
to exploitation.
Unsecure configurations may also include the default
enabling of unnecessary services
and can result in system exploitation.
Embedded secrets, such as hard-coded passwords or API keys,
are sensitive credentials stored directly
in source code or configuration files,
making them easily accessible to attackers
who gain access to the code base.
The impact of exposed embedded secrets can be severe
as attackers may misuse them to gain unauthorized access
to systems, escalate privileges,
or compromise sensitive data.
Outdated or unpatched software
and libraries often contain known vulnerabilities
that have not been addressed by updates.
The use of outdated
or unpatched software can result
in attackers gaining unauthorized system access,
executing malicious code,
or compromising the security of the entire system.
End-of-life software are applications
or systems that are no longer supported
with security updates by the vendor.
End-of-life software can be easily exploited
by attackers due to the lack of patches
for newly discovered threats.
Next, we will explore authorization vulnerabilities.
Authorization vulnerabilities occur
when a system improperly manages access controls,
allowing users to process
and perform actions beyond their intended permissions.
Authorization vulnerabilities include a confused deputy,
weak ciphers, and vulnerable third parties.
The confused deputy vulnerability arises when a program
with higher privileges is tricked into performing actions
on behalf of an attacker.
Confused deputies can bypass authorization checks.
Weak ciphers in encryption can lead
to ineffective protection of sensitive data,
enabling attackers to intercept or manipulate information
that should be securely transmitted.
Vulnerable third parties are external services
or partner organizations that, if compromised, can be used
to gain unauthorized access to a system's resources or data.
For example, if a web application
uses a vulnerable third party service with weak ciphers
for secure communications,
an attacker might exploit this weakness
to intercept encrypted data
or manipulate a confused deputy to gain unauthorized access
to restricted functions within the application.
Following that, we will look at malicious code attacks.
Malicious code attacks are the insertion of harmful software
or code into a system to disrupt, steal,
or manipulate data and operations.
Malicious code attack concepts
include implants and poisoning.
Implants are malicious code
or hardware inserted into a system, often stealthily.
Implants may create a persistent backdoor
that attackers can use for ongoing access
and control to a machine.
Poisoning occurs when attackers tamper with the data
or environment used by a system.
For example, poisoning could be used
to corrupt a machine learning model's training data
to alter its behavior,
or injecting malicious code into software updates.
Then we will explore hardware and firmware attacks.
Hardware and firmware attacks exploit vulnerabilities
in the physical components or embedded software of a system.
Firmware attacks could allow attackers
to gain deep access, control,
or disrupt operations at a fundamental machine level.
Hardware and firmware attacks may be recognized
by threat actor tactics, techniques and procedures,
or TTPs, such as firmware tampering, BIOS and UEFI attacks,
and USB-based attacks.
Firmware attacks involve modifying the embedded software,
called firmware, that controls hardware devices.
Firmware attacks are often used
to create persistent back doors
or alter device behavior in ways
that are difficult to detect.
BIOS and UEFI attacks specifically target
the low-level firmware responsible for booting up a system.
BIOS and UEFI attacks may give attackers control
over the device before the operating system even loads,
making these attacks especially hard to remove.
USB-based attacks use compromised
or malicious USB devices to deliver harmful code directly
to a system's hardware.
USB-based attacks bypass many traditional security measures
by exploiting the direct physical USB connection
to the system.
This direct connection may allow malicious code
to be executed at a low level even
before software-based defenses like antivirus programs
or firewalls can detect
or intercept the threat.
In application, an attacker might use a tampered USB drive
to introduce malicious code that modifies the BIOS
or UEFI firmware gaining control over a system at startup
and compromising the entire device at the lowest level.
Next, we will look at memory-based attacks.
Memory-based attacks exploit vulnerabilities
in a system's memory management to execute malicious code,
manipulate data, or cause system crashes.
Memory-based attacks include attacker tactics, techniques,
and procedures specific to memory and shimming.
These attacks often target the way a program allocates
and manages memory taking advantage
of vulnerabilities like buffer overflows
to inject or execute harmful code.
Shimming works by placing a malicious layer of code
that intercepts communication between the application
and the operating system,
allowing the attacker to modify inputs,
outputs, or system calls.
This manipulation can lead to unauthorized actions such
as privilege escalation, data theft,
or bypassing security controls,
all while remaining undetected
by traditional security measures.
For example, an attacker might exploit
a buffer overflow vulnerability in a vulnerable application
to inject a shim into the program's memory space.
This shim could then intercept and redirect system calls,
enabling the attacker to escalate their privileges
from a standard user to an administrator
or to exfiltrate sensitive data like passwords
or encryption keys,
all while bypassing standard security checks.
Finally, we will explore electromagnetic attacks.
Electromagnetic attacks use electromagnetic interference
or EMI or electromagnetic pulses
or EMP to disrupt, damage, or manipulate hardware and data.
Electromagnetic interference attacks
involve the deliberate emission of electromagnetic signals
that can interfere with the normal operation
of electronic devices.
Electromagnetic interference attacks can cause malfunctions
or data corruption in critical systems such
as medical devices, industrial control systems,
or communication networks, potentially leading
to significant operational disruptions and safety risks.
An electromagnetic pulse is a powerful burst
of electromagnetic energy,
often generated by specialized devices that can damage
or permanently disable electronic circuits
and components by overwhelming them
with a sudden surge of energy.
Electromagnetic pulse attacks may be used as a form
of denial of service attack to disrupt
or disable critical systems.
For example, an attacker
might use an electromagnetic pulse device
to disable a target facility's electronic security systems,
rendering alarms and cameras inoperative,
while simultaneously leveraging electromagnetic interference
to interfere with the operation
of sensitive equipment in data centers
or communication networks leading to significant disruption
and potential data loss across critical infrastructure.
To finish things off, we'll take a short quiz to see
what you learned during this section of the course,
and we'll review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into vulnerabilities
and attacks in this section of the course.