- There are many different vulnerabilities that
can affect an endpoint and then specifically
vulnerabilities that can then be weaponized
and converted into malware
or malicious software that can absolutely be catastrophic
to an organization and to an individual.
One of the most prolific pieces of malware and, you know
very disruptive as well is ransomware, right?
And we're gonna go and touch base
on the ransomware attacks a little bit later in this lesson
but whenever threat actors gain access to a systems
they usually want future access as well.
And they want it to be easy.
The attackers can then install things called back doors
and a backdoor is an application or commands
that the attacker can do to allow them future access
or to collect information
and use that information in further attacks.
Many back doors are installed by users
clicking on something without realizing
that the link that they clicked
or the file that they opened is a threat.
Still to this date
one of the biggest entry points for an attacker
to compromise a system is by leveraging emails
and social engineering attacks
and phishing, spearphishing, welding
and many other things that you also learned
throughout this course.
And again, there's tons
of different types of vulnerabilities.
But one specifically that I want to talk
about right now is buffer overflows and code execution.
Whenever threat actors and attackers gain access
to a system, they also may be able to take several actions.
The type of actions depend on the level
of access that the threat actor has or can achieve
and is based on permissions granted
to the account compromised by the attacker.
One of the most devastating actions available
to an attacker is the ability to execute code
within a device.
Code execution could result
in a very adverse impact to the confidentiality, integrity
and availability of the system and the network.
Now remote code execution
or what the industry refers to as RCE,
allows attackers to fully compromise the confidentiality
integrity and availability of a system, and then remotely,
so that means, you know, many network hops away
from the victim, manipulate that compromised system.
Right, now that type of manipulation
in many cases is done using a command
and control infrastructure, a command and control server.
Now that command and control server
can be another compromised device.
Like for example,
some unattended WordPress installation
that, you know, an organization or individual
actually left, you know, vulnerable in the internet,
or it can be even a legitimate service like Dropbox,
Photo Bucket, things like Twitter has been used
for command and control and to send information
to a compromised system on what other things to do.
And that other things to do can be launching a
denial service attack against, you know
another victim it can be to do even crypto mining in some
in some cases, right, but it can be many
many different things that the attacker wants to leverage.
That underlying system that is compromised.
Now, going back to buffer overflows
a buffer is basically a temporary data storage where
you know, the length is actually defined in the program,
and it's typically- buffer overflows are typically
perform or, or found
in applications written in C and C++
and basically involves many memory manipulation functions
in those languages where the program does not
perform bound checking and then can easily
override the allocated bounds of such buffer.
A perfect example of a function that I'm highlighting
in the screen is a string copy function that
can cause vulnerabilities whenever you use it incorrectly.
Now, in this example here,
I'm showing a very small chunk of data, you know,
being sent to a buffer
but whenever the attacker sends more information
or more data that can be put into that buffer
then that's where the buffer
overflow actually potentially occurs. Right? So,
a couple of things that actually can can happen.
One is that the application will crash
so you will get something like a segmentation fault
and you of course provide the ability
for the attacker to perform a denial service condition
or more catastrophic area is that the attacker
can then write to adjacent memory
and then perform code execution.
Now there's a lot of different ways that, you know
these type of buffer flows can be a leverage.
Now, a simplistic example of how
an attacker could then write instructions to a system
and potentially cause a local or remote code execution is
by using things called shell codes, which is basically a set
of instructions that will be used to manipulate the system
whether it's to launch another application
whether it's to actually create, you know
a stager to then download a piece
of malware like ransomware.
And I've been mentioning ransomware for quite some time
ransomware is a piece of malware that
again is extremely popular in the last few years
because criminals have used it to make a lot of money.
Basically the piece of software
this malicious software will encrypt
either fouls or your whole hard drive.
And then it will ask for a ransom.
It will ask for basically some monetary reward
in order for you to get the key to decrypt those files.
Unfortunately, you know, whenever, if you're even if you pay
and typically it's in the form of Bitcoin or some type
of cryptocurrency, even if you pay, in most cases
you will not get the key back from that hacker.
Yes, there are some cases and where
you will receive the key back
but in typically that's not the case.
Now, ransomware has also been used for
performing other types of attacks
or other types of motives, I will say.
The same attack, you know, the encrypting files
but instead of making money to cost disruption.
So in other words, to actually bring the application
the system or the network down to their needs, and, and
of course, you know, perform a den denial service condition.
And, you know, allegedly, you know, there have been a lot
of different ransomware attacks that have been launched
by different nation states
on where the main purpose was not to make money
but it was actually to perform some type of disruption.
Right now, there are a lot of different types
of avenues to basically weaponize a vulnerability.
And of course, you know
there there's that weaponization will depend
on the underlying operating system and so on.
But in many cases, actually it is because
of a similar vulnerability like above for overflow
or anything that will allow you to do code execution.
And again, there are many different types of vulnerabilities
and attacks that an attacker can leverage.
One of the best resources that you can use to learn
about the different types of vulnerabilities
and their effect, and also the mitigations,
is the open web application security project, or OWASP,
a website, and specifically the link
that I'm highlighting in the screen.
Another way that you can learn about the different types
of vulnerabilities and their effects, and the mitigations is
by basically doing hands-on exercises.
Now,
for this exam you do not need to be
an ethical hacker or a pen tester.
So you do not need to perform all these exercises,
but through your learning process, it will absolutely help
especially in cybersecurity, cybersecurity's like math
the more you practice, the better you will become
but it will definitely help to get
some type of hands-on experience in,
in some of these attack scenarios.
Now, what you're seeing in this screen is something
that I created called Websploit labs,
and it's a learning environment that I created
for different courses, some for ethical hacking
and web penetration testing
and several other ones that I perform and,
and of course, for other books that have written.
Now this environment has
about 8,000 to 9,000 different
cyber security resources, including sample code, you know
of course, tutorials and many different exercises.
It has at least 850 exercises or so.
What it is is you can deploy either Kali Linux
or Parrot Security
which are the most common ethical hacking Linux, you know
and penetration testing distribution.
And there are many others, but these two are based on DBN.
And once you download those in,
in a VM, let's say right in virtual box, VMware
or ESXi or KVM or Proxmox
then you run this script
and basically what that will do is we'll
install a whole bunch of tools that do not come
with those distributions as well as different containers
that are running intentional vulnerable applications
that you can actually practice your skills
in a safe environment within one VM.
So again, only within this environment, you have
over 450 different types of exercises that you can complete
including buffer overflows, sequel injection, and a lot
of the vulnerabilities that we have been talking
about in this course.