Vulnerabilities#

Security vulnerabilities are any kind of software or hardware defect.
A program written to take advantage of a known vulnerability is referred to as an exploit.
A cybercriminal can use an exploit against a vulnerability to carry out an attack, the goal of which is to gain access to a system, the data it hosts or a specific resource.

Vulnerability Management#

The process of finding and patching vulnerabilities.

Identify vulns
Consider potential exploits
Prepare defences against threats
Evaluate those defenses

Hardware Vulnerabilty#

Hardware vulnerabilities are most often the result of hardware design flaws.
eg:

Rowhammer
Meltdown
Spectre

Software Vulnerability#

Software vulnerabilities are usually introduced by errors in the operating system or application code.

ProxyLogon: A pre-authenticated vulnerability that affects the Microsoft Exchange server. This means a threat actor can complete a user authentication process to deploy malicious code from a remote location.
ZeroLogon: A vulnerability in Microsoft’s Netlogon authentication protocol. An authentication protocol is a way to verify a person’s identity. Netlogon is a service that ensures a user’s identity before allowing access to a website’s location.
Log4Shell: Allows attackers to run Java code on someone else’s computer or leak sensitive information. It does this by enabling a remote attacker to take control of devices connected to the internet and run malicious code.
PetitPotam: Affects Windows New Technology Local Area Network (LAN) Manager (NTLM). It is a theft technique that allows a LAN-based attacker to initiate an authentication request.
Security logging and monitoring failures: Insufficient logging and monitoring capabilities that result in attackers exploiting vulnerabilities without the organization knowing it
Server-side request forgery: Allows attackers to manipulate a server-side application into accessing and updating backend resources. It can also allow threat actors to steal data.

Input Validation and Injection Vulnerabilities#

Programs often require data input, but this incoming data could have malicious content, designed to force the program to behave in an unintended way.

Access control problems#

Access control is the process of controlling who does what and ranges from managing physical access to equipment to dictating who has access to a resource, such as a file, and what they can do with it, such as read or change the file. Many security vulnerabilities are created by the improper use of access controls.

Buffer overflow#

Buffers are memory areas allocated to an application. A vulnerability occurs when data is written beyond the limits of a buffer. By changing data beyond the boundaries of a buffer, the application can access memory allocated to other processes. This can lead to a system crash or data compromise, or provide escalation of privileges.

Race conditions #

This vulnerability describes a situation where the output of an event depends on ordered or timed outputs. A race condition becomes a source of vulnerability when the required ordered or timed events do not occur in the correct order or at the proper time.

Cryptographic & Security Practice Flaws#

Systems and sensitive data can be protected through techniques such as authentication, authorization and encryption. Developers should stick to using security techniques and libraries that have already been created, tested and verified and should not attempt to create their own security algorithms. These will only likely introduce new vulnerabilities.

Common Patterns

Using deprecated or weak algorithms like MD5, SHA-1, or ECB mode
Hard-coded secrets in code or configuration
Poor key rotation or management practices
Lack of encryption for sensitive data at rest or in transit
Self-signed or invalid TLS certificates
Using AI/ML systems without proper secret handling for model parameters or sensitive inputs

How To Prevent It

Use strong, modern algorithms such as AES-GCM, ChaCha20-Poly1305, or enforce TLS 1.3 with valid certificates
Use secure key management services like Azure Key Vault, AWS KMS, or HashiCorp Vault
Rotate secrets and keys regularly, following defined crypto periods
Document and enforce policies and standard operating procedures for key lifecycle management
Maintain a complete inventory of certificates, keys, and their owners
Ensure AI models and automation agents never expose unencrypted secrets or sensitive data

Attacks#

In cybersecurity, an attack is any intentional action taken by a threat actor to compromise the confidentiality, integrity, or availability (CIA triad) of a system, network, application, or data.

An attack is a deliberate attempt to exploit a vulnerability in order to gain unauthorized access, cause disruption, or steal/damage information.

Common Attacks#

A computer virus is malicious code written to interfere with computer operations and cause damage to data and software.
Today, viruses are more commonly referred to as Malware, which is software designed to harm devices or networks.

In 1986, the Alvi brothers created the Brain virus, although the intention of the virus was to track illegal copies of medical software and prevent pirated licenses
In 1988, Robert Morris developed a program to assess the size of the internet. The program crawled the web and installed itself onto other computers to tally the number of computers that were connected to the internet.The program, however, failed to keep track of the computers it had already compromised and continued to re-install itself until the computers ran out of memory and crashed. About 6,000 computers were affected, representing 10% of the internet at the time. This attack cost millions of dollars in damages due to business disruptions and the efforts required to remove the worm.
After the Morris worm, Computer Emergency Response Teams, known as CERTs®, were established to respond to computer security incidents. CERTs still exist today, but their place in the security industry has expanded to include more responsibilities.

Social engineering is a manipulation technique that exploits human error to gain private information, access, or valuables.

eg: Loveletter attack.in year 2000, Onel De Guzman created the LoveLetter malware to steal internet login credentials.

Phishing is the use of digital communications to trick people into revealing sensitive data or deploying malicious software.

the Equifax breach. In 2017, attackers successfully infiltrated the credit reporting agency, Equifax. This resulted in one of the largest known data breaches of sensitive information. Over 143 million customer records were stolen, and the breach affected approximately 40% of all Americans.

Attack types#

Network Attacks #

Physical attack#

A physical attack is a security incident that affects not only digital but also physical environments where the incident is deployed. Some forms of physical attacks are:

Malicious USB cable
Malicious flash drive
Card cloning and skimming
Physical attacks fall under the asset security domain.

Adversarial artificial intelligence#

Adversarial artificial intelligence is a technique that manipulates artificial intelligence and machine learning ↗ technology to conduct attacks more efficiently. Adversarial artificial intelligence falls under both the communication and network security and the identity and access management domains.

Supply-chain attack#

A supply-chain attack targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed. Because every item sold undergoes a process that involves third parties, this means that the security breach can occur at any point in the supply chain. These attacks are costly because they can affect multiple organizations and the individuals who work for them. Supply-chain attacks can fall under several domains, including but not limited to the security and risk management, security architecture and engineering, and security operations domains.
Common Patterns

Using unverified or unmaintained libraries and dependencies
Automatically installing updates without verification
Over-reliance on third-party AI models without monitoring or auditing
Insecure build pipelines or CI/CD processes that allow tampering
Poor license or provenance tracking for components
Lack of monitoring for vulnerabilities in dependencies after deployment

How To Protect The Supply Chain

Verify all third-party components, libraries, and AI models before use
Monitor and patch dependencies regularly
Sign, verify, and audit software updates and packages
Lock down CI/CD pipelines and build processes to prevent tampering
Track provenance and licensing for all dependencies
Implement runtime monitoring for unusual behaviour from dependencies or AI components
Integrate supply chain threat modelling into the SDLC, including testing, deployment, and update workflows

Cryptographic attack#

A cryptographic attack affects secure forms of communication between a sender and intended recipient. Some forms of cryptographic attacks are:

Birthday
Collision
Downgrade
Cryptographic attacks fall under the communication and network security domain.

Malware #

DoS and DDoS Attacks #

On-Path Attacks - MITM or On-Path Attacks #

On-path attackers intercept or modify communications between two devices, such as a web browser and a web server, either to collect information from or to impersonate one of the devices.
This type of attack is also referred to as a man-in-the-middle or man-in-the-mobile attack.

A MitM attack happens when a cybercriminal takes control of a device without the user’s knowledge. With this level of access, an attacker can intercept and capture user information before it is sent to its intended destination. These types of attacks are often used to steal financial information.

There are many types of malware that possess MitM attack capabilities.
A variation of man-in-middle, MitMo is a type of attack used to take control over a user’s mobile device. When infected, the mobile device is instructed to exfiltrate user-sensitive information and send it to the attackers. ZeuS is one example of a malware package with MitMo capabilities. It allows attackers to quietly capture two-step verification SMS messages that are sent to users.

SEO Poisoning#

You’ve probably heard of search engine optimization or SEO which, in simple terms, is about improving an organization’s website so that it gains greater visibility in search engine results.
Search engines such as Google work by presenting a list of web pages to users based on their search query. These web pages are ranked according to the relevancy of their content.
While many legitimate companies specialize in optimizing websites to better position them, attackers take advantage of popular search terms and use SEO to push malicious sites higher up the ranks of search results. This technique is called SEO poisoning.
The most common goal of SEO poisoning is to increase traffic to malicious sites that may host malware or attempt social engineering.

Wi-Fi Password Cracking#

We are able to identify unencrypted passwords by listening in and capturing packets sent on the network. This is called network sniffing. If the password is encrypted, they may still be able to reveal it using a password cracking tool.

Password Attacks #

Advanced Persistent Threats#

Attackers also achieve infiltration through advanced persistent threats (APTs) — a multi-phase, long term, stealthy and advanced operation against a specific target. For these reasons, an individual attacker often lacks the skill set, resources or persistence to perform APTs.
Due to the complexity and the skill level required to carry out such an attack, an APT is usually well-funded and typically targets organizations or nations for business or political reasons.
Its main purpose is to deploy customized malware on one or more of the target’s systems and remain there undetected.

Vulns & Attacks