Vulnerabilities

This objective focuses on vulnerabilities, the actual weaknesses or flaws in software, hardware, networks, or configurations that attackers exploit. To master this for the exam, it helps to categorize them by their position in the technology stack.

1. Application Vulnerabilities

These flaws arise from insecure software development practices, logic errors, or poor memory management in the code.

• Memory Injection: An attacker inserts malicious code into a running computer program’s memory space, forcing the application to execute commands it shouldn’t.
• Buffer Overflow: This occurs when an application writes more data to a temporary memory buffer than it is designed to hold. The extra data overflows into adjacent memory spaces, corrupting data, crashing the system, or executing malicious code.
• Race Conditions: A vulnerability where the system’s behavior depends on the sequence or timing of uncontrollable events. It occurs when multiple processes attempt to modify the same resource simultaneously.
  • Time-of-Check (TOC) vs. Time-of-Use (TOU): A specific type of race condition. The system checks a security condition (TOC) like a file permission, but before it uses the resource (TOU), an attacker rapidly swaps out the file. The system then executes the action on the malicious file, assuming it’s still safe.
• Malicious Update: An attacker compromises a software vendor’s update server or development pipeline, pushing out a legitimate-looking update containing embedded malware to thousands of downstream users.

2. Operating System (OS) and Web-Based Vulnerabilities

Weaknesses built directly into the underlying OS platform or web applications exposed to the internet.

• Operating System (OS)-Based: Flaws in the OS kernel, system services, or native APIs (such as vulnerabilities in Windows Print Spooler or Linux systemd) that allow local users to escalate privileges or remote attackers to execute code.
• SQL Injection (SQLi): An attacker inserts malicious SQL code into a web application’s input fields (such as a login or search box). If the input isn’t validated, the database interprets it as a command, allowing the attacker to bypass authentication, read sensitive records, or delete data.
• Cross-Site Scripting (XSS): An attacker injects a malicious client-side script (usually JavaScript) into a trusted website. When an innocent user visits that site, their web browser executes the script, allowing the attacker to steal the user’s active session cookies or keystrokes.

3. Hardware & Virtualization Vulnerabilities

Physical assets and abstraction layers that lack modern security features or fail to cleanly isolate environments.

• Hardware Flaws:
  • Firmware: Weaknesses in the low-level software programmed directly into hardware components (such as BIOS/UEFI, routers, or hard drive controllers) that can allow persistent, hard-to-detect access.
  • End-of-Life (EOL) / Legacy: Systems or devices that are no longer supported or patched by the manufacturer, leaving discovered vulnerabilities permanently unfixable.
• Virtualization Flaws:
  • VM Escape: An extremely severe vulnerability in which an attacker on a single Virtual Machine (VM) exploits a hypervisor flaw to break out of their isolated space and access the underlying physical host operating system or other guest VMs.
  • Resource Reuse: Occurs when a hypervisor reassigns memory or storage space from a deleted VM to a new one without first completely wiping it, potentially leaking sensitive data from the old system to the new owner.

4. Cloud-Specific & Misconfiguration Vulnerabilities

The cloud introduces unique risks, primarily centered around complex configurations and shared infrastructure.

• Cloud-Specific: Vulnerabilities native to cloud environments, such as exposed API endpoints, insecurely configured cloud object storage (like wide-open AWS S3 buckets), or overly permissive Identity and Access Management (IAM) roles.
• Misconfiguration: Human errors where systems are deployed with weak settings out of the box. This includes leaving default passwords unchanged, enabling unnecessary protocols, or leaving debugging features active in production environments.

5. Supply Chain Vulnerabilities

A breakdown of trust in which an organization’s security is compromised by an external partner providing critical resources.

• Service Provider: Weaknesses stemming from outsourced companies (like managed IT services or cloud providers) that maintain backend access to your environment.
• Hardware Provider: Counterfeit or tampered hardware delivered with pre-installed malicious components or firmware tracking capabilities built directly into the silicon chips during manufacturing.
• Software Provider: Weaknesses introduced via third-party libraries, open-source modules, or commercial software components that your internal applications rely on.

6. Cryptographic, Mobile, & Zero-Day Vulnerabilities

• Cryptographic Vulnerabilities: Using broken, weak, or deprecated cryptographic algorithms (such as MD5 or SHA-1 for hashing, or RC4 for encryption) that can be easily cracked or bypassed with modern computing power.
• Mobile Device Flaws:
  • Sideloading: Installing applications from third-party sources outside official, curated marketplaces (like the Apple App Store or Google Play Store), bypassing initial security screening.
  • Jailbreaking / Rooting: Modifying a mobile operating system to remove manufacturer restrictions and gain full administrative privileges. This completely disables built-in sandboxing protections, making the device highly susceptible to malware.
• Zero-Day: A software vulnerability that is completely unknown to the vendor or public, meaning there are zero days of protection or patches available. Attackers highly prize these because standard signature-based defenses cannot detect them.