Vulnerabilities and Attacks

Vulnerability

Weakness or flaw in hardware, software, configurations, or processes

Attack

Deliberate action by a threat actor to exploit a vulnerability

Hardware Vulnerability

Flaw in a device's physical components or design that compromises CIA

Firmware Vulnerability

Flaw in the specialized software stored on hardware; can give attackers full control

End-of-Life System

No longer updated or supported by the manufacturer

Legacy System

Outdated system superseded by newer alternatives

Unsupported System

No official support, security updates, or patches

Unpatched System

Device or software missing the latest security patches; exposed to known exploits

Hardware Misconfiguration

Incorrect device settings that create vulnerabilities

Hardening

Closing unnecessary ports, disabling services, and setting permissions to tighten security

Configuration Enforcement

Making sure devices follow secure configurations

Decommissioning

Retiring end-of-life or legacy systems that pose risks

Isolation

Separating vulnerable systems from the enterprise network

Segmentation

Dividing a network into segments to limit the impact of a breach

Insecure Pairing

Bluetooth devices connecting without proper authentication

Device Spoofing

Attacker impersonates a device to trick a user into connecting

Bluejacking

Sending unsolicited messages to a Bluetooth device; harmless pranks

Bluesnarfing

Unauthorized Bluetooth access to steal contacts, call logs, and texts

Bluebugging

Taking control of a device's Bluetooth functions to make calls, send messages, or access the internet

Bluesmack

Bluetooth DoS that overwhelms a device with data

BlueBorne

Bluetooth attack that spreads through the air and infects devices with no user interaction

Bluetooth Best Practices

Turn off when unused, non-discoverable mode, update firmware, pair only with trusted devices, use unique PINs

Sideloading

Installing apps from unofficial sources outside the official app store

Jailbreaking/Rooting

Removing OS restrictions to gain escalated privileges; blocks manufacturer updates

Insecure Connection Methods

Open Wi-Fi or pairing with unknown Bluetooth devices

Zero-Day Vulnerability

Flaw discovered or exploited before the vendor has a patch

Zero-Day Exploit

Attack targeting a previously unknown vulnerability

Bug Bounty

Program that pays researchers to find and report vulnerabilities

Malicious Update

Fake update that looks legitimate but contains malware; verify with digital signatures and hashes

Injection Attack

Sending malicious data to a system to cause unintended behavior

SQL

Structured Query Language; used to interact with databases (SELECT, INSERT, DELETE, UPDATE)

SQL Injection

Inserting malicious SQL code into input fields, URLs, cookies, or headers; signature: ' OR 1=1

Preventing SQL Injection

Input validation, sanitizing user data, and using a WAF

XML Injection

Inserting malicious XML into data an application processes

XML Bomb (Billion Laughs)

XML that expands exponentially to consume memory, causing DoS

XXE (XML External Entity) Attack

XML that tries to read local files, like /etc/shadow

Cross-Site Scripting (XSS)

Injecting a malicious script into a trusted site so it runs in visitors' browsers

Non-Persistent (Reflected) XSS

XSS that only happens once when launched; server-side

Persistent (Stored) XSS

XSS code stored in the website's backend database; server-side

DOM XSS

Client-side XSS that modifies the Document Object Model in the victim's browser

Session Management

Lets web apps uniquely identify a user across multiple requests

Cookie

Text file storing information about a user's visit to a website

Non-Persistent Cookie

Aka session cookie; stored in memory and deleted at session end

Persistent Cookie

Stored in the browser cache until deleted or expired

Session Hijacking

Spoofing attack where the attacker disconnects a host and takes over its session

Session Prediction

Guessing the session token to hijack a session; prevent with non-predictable tokens

Cross-Site Request Forgery (CSRF/XSRF)

Exploits a session the user already has open on another site in the same browser

Preventing CSRF

User-specific tokens in forms, extra prompts or 2FA for password resets, and requiring the current password to change it

Buffer Overflow

Writing more data than a memory buffer can hold so it spills into adjacent memory

Stack

Reserved memory area for data during processing; first in, last out

Smashing the Stack

Overwriting the return address with a pointer to malicious code

NOP Slide

Filling a buffer with No-Operation instructions so execution slides to the attacker's code

ASLR (Address Space Layout Randomization)

Randomizes memory addresses so attackers can't predict where code lives

Race Condition

Vulnerability from the timing and order of events when processes access shared resources simultaneously

Dereferencing

Code removes the link between a pointer and what it pointed to, allowing changes

Dirty COW

Real race condition exploit in the Linux/Android Copy-On-Write function

Time-of-Check (TOC)

Attacker changes a resource after it is checked but before it is used

Time-of-Use (TOU)

Attack focused on altering a resource at the moment it is used

Time-of-Evaluation (TOE)

Attacker manipulates data during the system's decision-making process

TOCTOU

Time-of-Check to Time-of-Use; the gap race condition attacks exploit

Mutex

Mutually exclusive flag letting only one thread access a code section at a time

Deadlock

A lock stays in place because the process it waits on crashed or never finished