- [Instructor] Understanding the weaknesses
and vulnerabilities in a system or network
is a huge step towards correcting the vulnerability itself,
or putting in appropriate counters
to mitigate threats against those vulnerabilities.
So, potential network vulnerabilities are bound
with many resulting from one or more of the following.
The first is policy flaws, design errors,
protocol weaknesses, and that can be in the form
of the actual protocol standard,
or the specification of that protocol,
or the implementation of that protocol.
So, both a standard or implementation issues.
Misconfigurations of a system contribute,
or can be considered as vulnerabilities,
and goes without saying, software vulnerabilities as well.
The human factor, that's a contributing factor
for vulnerabilities and specifically related to two things,
just normal errors, human errors,
and also social engineering.
Also hardware vulnerabilities,
there are vulnerabilities in hardware as well
not only software, and physical access to network resources.
Now, Cisco and others have actually created databases
that categorize vulnerabilities
and also threats in the public domain.
Now, whenever you actually look at these databases
and the vulnerability reports,
you often see an identifier, a vulnerability identifier,
and that's done using the common vulnerability,
and exposures standard, which is a dictionary
of publicly known security vulnerabilities and exposures.
So, quick search using your favorite search engine
will lead you to the website,
as far as actually the CVE website,
but it's actually maintained by Mitre,
I'm showing the link here.
And again, typically whenever you see disclosures,
you see these type of identifiers,
they start with the acronym CVE, and then dash,
followed by a year, so by the date
when the vulnerability was actually disclosed.
So, again, the year, and then dash,
and then an identifier, a number.
Now, there are also databases or repositories.
The most popular one is the National Vulnerability Database,
or NVD, and I'm actually sharing the link in here,
and a screen share of their site.
And this is actually a repository
of standards based vulnerability information.
Again, there you can actually do quick searches
for vulnerabilities, you can obtain information
about the details of vulnerabilities,
and references to the reports of those vulnerabilities,
and the vendor disclosure of those vulnerabilities.
Now, here are a few examples
of the most common type of vulnerabilities.
So, the first one is API abuse.
And these are vulnerabilities are aimed to attack flaws
in an Application Programmable Interface or an API.
There's also authentication,
and authorization bypass vulnerabilities,
where you can bypass an authentication of a system,
or bypass authorization, a process on that system.
The very popular one, and unfortunately,
one of the most culprit of a lot of vulnerabilities
out there is actually a buffer overflow.
And a buffer overflow is when a program or a software
puts more data in the buffer than it can hold,
or it's actually also when a program tries
to put data in a memory location past that buffer.
This is done so data outside of the bounds of a block
of that allocated memory can corrupt data,
or crash the program, or the operating system as a whole.
And the worst case scenario
is actually leading to code execution,
so execution of malicious code,
and the worst, definitely worst case scenario
is remote code execution,
into the fact that you can manipulate and gain access
to a system remotely, sort of from hops away,
and over the internet.
Now, there's a wide variety of ways
that buffer overflows can occur, and unfortunately,
there are many error prone techniques often used
to prevent them.
So, buffer workflow,
typically involves many memory manipulation functions,
like in languages, like C and C++,
where the actual program do not perform bound checking.
And they can also easily override the allocated bounds
of those buffers.
A perfect example is string copy,
tat can cause vulnerabilities when using correctly.
That's a very typical one that we have seen for the last,
you know, several years.
So, here's an example code that actually shows a buffer.
So, that buffer actually includes a small chunk of data.
And that data is actually Hello World, in my example.
So, an attacker actually can take advantage
of this vulnerability to send data that can put
that data in a memory location past that buffer,
as I'm showing here.
So again, as you can see here
that the actual attacker sent the data,
and in this case, the data is called Every World, and then,
that was more than the buffer actually could hold.
Subsequently, actually,
he's writing to the adjacent memory location.
So, of course in this example is a very simplistic one,
but it represents how an attacker
can then write instructions to the system,
and potentially cause a local or remote core execution.
So, in several of these attacks,
the attacker actually writes what we call shell code.
And, that shell code is actually used to invoke instructions
and manipulate the system.
Now, moving along, there's another type of vulnerabilities
that is very common, and unfortunately,
very pervasive nowadays,
is a Cross-site scripting vulnerability.
So, the short is XSS.
And this is a type of web application vulnerability,
where militia scripts are injected
into legitimate and trusted websites.
So an attacker actually can launch an attack
against a cross-site scripting vulnerability
using a web application,
and does that to send malicious code,
typically in the form of a browser-site script,
you know, this is actually done to a user,
to fool a user to potentially follow a malicious link,
or you know, many other things.
Now, cross-site scripting vulnerabilities
are quite widespread, and occurs anywhere
where web application uses input from a user,
you know, within the output that it generates
without validating or encode it.
So there's several types
of cross-site scripting vulnerabilities.
So you have things
like reflected cross-site scripting vulnerabilities,
stored a cross-site scripting vulnerabilities,
and, you probably don't have to go into that detail
for the exam, but I'll invite you to visit the document
that I'm actually sharing here,
because Cisco actually has documented,
and explained all the different types
of cross-site scripting vulnerabilities available,
and I'm including a link here for your reference.
Another type of web-based vulnerability,
or web application vulnerability
is a Cross-Site Request Forgery or CSRF.
And this is a vulnerability that forces an end-user
to execute malicious steps on a web application.
So, this is typically done after the user is authenticated
in that application, and it generally, this type of attacks,
or CSRF attacks target stage chaining request,
and the the attacker cannot steal data
since he or she has no way to see the response
to the forge request.
So, the CSRF attacks are actually carried with a combination
of course technical implementations,
but also social engineering.
Another type of vulnerabilities
is cryptographic vulnerabilities.
So these are vulnerabilities and flaws
of cryptographic protocols or their implementation.
Another one is that the deserialization
of untrusted data vulnerabilities.
They use or cause malformed data or an expected data
to actually abuse an application logic.
And they can actually cause a denial of service attack
or denial of service condition,
or even execute arbitrary code.
Another type of vulnerabilities, a double free.
And these are vulnerabilities typically in languages
like C and C++ that actually occur
when the actual free function is called more than once,
and with the same memory address as an argument.
So, that's another type of common vulnerabilities
throughout specifically these languages,
I mean, implementations.
Now, insufficient entropy is another type of vulnerability.
And this is a vulnerability when a cryptographic application
does not have proper entropy.
An example of this is whenever a PRNG,
or a Pseudo Random Number Generator
can be susceptible to insufficient entropy.
And this type of vulnerability are leverage by attackers
to actually be able to weaken,
or attack the cryptographic application,
because there's no proper entropy,
and it's very easily to actually be guessable.
And these are typically susceptible whenever these PRNGS,
or the Pseudo Random Numbers Generators
are actually initialized.
Now, there's another type of vulnerability
that is also fairly popular.
This vulnerability is SQL injection.
And this actually is whenever an attacker can insert,
or inject a SQL query via the input data
from either a client to the application,
or to a specific database,
or through a web-base application,
and then, of course subsequently
actually inject this to the database.
So, attackers can actually exploit
SQL injection vulnerabilities to read sensitive data
from the database, or to modify or delete database data.
So, they can also execute administration operations
on the database, and even issue commands
to the operating system.
These are pretty serious type of vulnerabilities,
and, of course, if they're leveraging correctly,
all bets are off,
the sensitive data can definitely be stolen,
and ex filtrated out of their organization,
or completely render the database useless,
or delete the data in the database.
So, there are many many other types of vulnerabilities.
So, if we actually enumerate all of them
we'll be here for a long, long, long time,
but I wanted to share with you a really good reference,
a really good website
that actually has tons of different types
of vulnerabilities, and how they actually are introduced,
but not only that, but how they can be mitigated.
And that is actually the OWASP, or the OWASP Foundation.
And I'm actually sharing their website here.
OWASP is a nonprofit charitable organization
that has been dedicated to educate many organizations
to develop, acquire, operate, and maintain applications
that actually can be trusted.
So, that's actually their motto, or their slogan.
They maintain many different resources
that security professionals actually can use to learn
about different attacks, and different vulnerabilities.
And again, not only learn about these type
of vulnerabilities, but also how to protect them,
and how to proactively not introduce those vulnerabilities
from the beginning.