security+ studying week 3

Malicious update

A software update that has attacker code embedded in it. Installing an update is effectively installing a new application, so it carries the same risk of containing malware

Update best practices

Always have a backup before changing a system so you can revert if something goes wrong, and only get updates from trusted sources commonly associated with that software

Fake update pop up warning sign

An "Update now" message that appears while browsing (e.g. after clicking a search result) may not be legitimate. A prompt that appears when the browser first starts, before visiting any sites, is more trustworthy

Most trustworthy place to manually download an update

Directly from the application developer's site

Digitally signed update

An update signed by the developer (e.g. Microsoft, Adobe, Google) whose signature is validated by the operating system, giving high trust that the update is legitimate

Built in application update process

The app updates itself and automatically performs security checks and signature verification. High trust and no manual downloads, but not a 100% guarantee

SolarWinds Orion attack

Attackers breached SolarWinds' development systems and inserted malicious code into Orion. The code was digitally signed and automatically pushed as normal updates in March and June 2020 to about 18,000 customers (Fortune 500 and US government) and was not detected until December 2020

SolarWinds victims

Microsoft, Cisco, Intel, the Pentagon, Homeland Security, and the Department of the Treasury, among others. Attackers moved from Orion systems to other systems in those networks

Lesson of SolarWinds

Even a trusted, digitally signed, automatic update process can distribute malware, and supply chain breaches can go undetected for months

Why operating systems are attractive targets

Everyone runs one, and they are extremely complex (Windows 11 has tens of millions of lines of code). More code means more undiscovered vulnerabilities

Patch Tuesday

The second Tuesday of each month, when Microsoft releases its monthly set of security patches

May 2023 Patch Tuesday

Almost 50 security patches, including 8 elevation of privilege, 4 security feature bypass, and 12 remote code execution vulnerabilities. April 2023 had almost 100

MSRC

Microsoft Security Response Center (msrc.microsoft.com), where you can see the latest Windows security patches

Why patch as quickly as possible

Once a vulnerability is announced, attackers reverse engineer it to create attack code. Patching before they do keeps your system safe

Testing patches

Large environments with hundreds or thousands of devices should test patches before deploying to production to make sure they don't break anything

Patches that require a reboot

Patches to core parts of the OS may need a reboot to fully apply, so save all data first

Why backups matter for patching

Even with testing, a patch can cause problems in production. A known good backup lets you return to the prior configuration

Code injection

An attack where the attacker puts their own code into data input to an application. Developers must add input checks to prevent it. Types include HTML, SQL, and XML injection

SQL

Structured Query Language, the most popular way for an application to interact with a database

SQL injection (SQLi)

Inserting your own SQL code into the query an application sends to a database, possible when the application doesn't properly check input

Normal SQL query example

SELECT * FROM users WHERE name = 'Professor' returns only the record for the name Professor

OR 1=1 SQL injection

Adding OR '1'='1' to input, e.g. SELECT * FROM users WHERE name = 'Professor' OR '1'='1'. Since 1 always equals 1, the database returns everything. Seeing 1=1 in a query strongly suggests SQLi

Why SQL injection is dangerous

Easy to exploit (just type extra code into the app's input fields in a browser, no extra software or user clicks needed) and gives full control to view, modify, delete, or take down the database

WebGoat

An intentionally vulnerable web application (webgoat.org) used to practice attacks like SQL injection

Cross site scripting (XSS)

A common web app vulnerability where an attacker's script runs in a victim's browser, taking advantage of the trust a browser has for a website. Abbreviated XSS because CSS already means Cascading Style Sheets

Language most XSS attacks use

JavaScript, since practically everyone has it enabled in their browser

Basic XSS attack flow

Attacker sends victim a link containing a malicious script, victim clicks it and goes to a trusted site, the script runs in the background and sends cookies, session details, and other private data to the attacker

Nonpersistent (reflected) XSS

A site allows scripts in user input fields. The attacker sends the victim a link exploiting this, the victim runs the script against the third party site, and the session ID is sent to the attacker, who gains the same access as the victim

XSS shopping cart example

A credit card field did not check for scripts, so JavaScript pasted into it displayed the session ID. In a real attack the session ID would be silently sent to the attacker

Persistent (stored) XSS

The attacker stores a malicious payload on a site (e.g. a social media post). Everyone who views the page runs the script, and it can spread by automatically reposting itself to viewers' feeds

Subaru XSS (2017)

Researcher Aaron Guzman found Subaru website tokens never expired, allowed any service request on a vehicle, and could be used on other accounts after adding an email. An XSS flaw let attackers steal tokens for permanent vehicle access. Subaru fixed it after disclosure

XSS protection for users

Don't click untrusted links (type trusted domain names yourself), consider disabling or limiting JavaScript, and keep browsers and applications updated

XSS protection for developers

Validate all application inputs so users cannot add their own scripts

Firmware

The operating system running inside a hardware device. Usually only the manufacturer can update or manage it

IoT security concern

Internet of Things devices (stoves, fridges, garage doors, door locks, thermostats, time clocks) are network connected computers running firmware we don't control, so each one is a potential risk

Trane ComfortLink II thermostats

Trane was notified of vulnerabilities in April 2014 but didn't release a patch until April 2015, and another in January 2016, showing hardware makers can be very slow to patch

End of Life (EOL)

Manufacturer notice that it will stop selling a product. Security patches may still be available for a while. An early warning to plan replacement

End of Service Life (EOSL)

Manufacturer no longer provides support or security patches (except maybe expensive premium support). Replace the device as soon as possible

Legacy platform

An old device or application that has been running for years, possibly with an outdated OS, application, or middleware at EOL or EOSL

Mitigating a critical legacy system

If it can't be removed, compare the risks, add firewall rules limiting who can connect, add IPS signatures for older OSes, and plan a replacement path

VM security challenges

VMs are constantly created and torn down with different configurations, making security posture hard to manage. Apply the same best practices as physical systems. Can still have privilege escalation, command injection, and information disclosure

VM escape

Breaking out of one virtual machine to access the hypervisor and other VMs on the same hypervisor, potentially exposing huge amounts of data

Pwn2Own

A hacking competition where if you can pwn (own) the device, you get to take it home

Pwn2Own 2017 VM escape

Attackers used a JavaScript engine bug in Microsoft Edge to reach the Edge sandbox, exploited a Windows 10 kernel flaw for full guest OS access, then used a VMware hardware simulation bug to jump to another VM

Resource reuse

A hypervisor can allocate more resources than physically exist (e.g. three VMs with 2 GB each on a 4 GB host), so memory is shared. A hypervisor bug could let one VM read memory written by another

Cloud security statistics

About 76% of organizations don't use MFA for their cloud console, and up to 63% of code in the cloud is unpatched

CVSS

Common Vulnerability Scoring System, rates vulnerabilities on a 0 to 10 scale. 7 or higher is significant

Denial of Service (DoS)

An attack that makes an application unavailable. Public cloud apps can be targeted by anyone in the world

Distributed Denial of Service (DDoS)

A DoS attack performed by many devices simultaneously

Cloud authentication risk

Weak or misconfigured authentication can let people into an application without proper credentials, causing a data breach

Directory traversal

A misconfiguration letting users manually move through a web server's folders and subdirectories

Remote code execution (RCE)

An attacker runs any code they want on a remote system, often by exploiting an unpatched vulnerability

Log4j and Spring Cloud Function

Recent vulnerabilities that were very easy to exploit and gave attackers full control of the system

Out of bounds write

Writing data into memory the user isn't authorized to use, which can lead to remote code execution or a system crash

Supply chain

Every step of getting a product from raw materials to the consumer: raw materials, suppliers, manufacturers, distributors, customers, consumers. Attackers can inject malicious code at any step

Service provider risk

Third parties managing your systems (network, utilities, cleaning, payroll, cloud) may have access to sensitive data. If they're breached, so are you

Service provider security audits

Ongoing audits of providers' security, usually written into the contract

Target breach (November 2013)

Attackers phished a Pennsylvania HVAC vendor with malware in email, used its access to Target's HVAC systems, which were on the same network as the cash registers, and installed malware on every register. Over 40 million credit cards stolen

Lesson of the Target breach

Non IT service providers can provide unintended network access, and networks should be segmented so one system can't reach another

Hardware supply chain best practices

Use a small list of trusted vendors, have acquisition and implementation policies, and treat new hardware as untrusted out of the box

Counterfeit Cisco hardware (July 2022)

DHS arrested a reseller who sold over $1 billion of fake Cisco switches and routers through about 30 companies since 2013. Made in China, they broke and sometimes caught fire

Software supply chain trust

Check digital signatures on installs and updates. Automatic updates require high trust. Open source isn't automatically safe since anyone with access to the code can make malicious changes

Open permissions

Leaving data on the internet without security. Attackers routinely scan for unsecured cloud data as reconnaissance

Verizon data exposure (June 2017)

A third party left 14 million Verizon records in an open Amazon S3 repository with no password. Found by a researcher, not an attacker

Unsecured admin accounts

Superuser accounts (root in Linux, Administrator in Windows) with easy to guess passwords like 123456, which attackers can brute force

Admin account best practices

Disable direct admin login, log in as a normal user and elevate with su or sudo (Linux) or Run as administrator (Windows), and keep very few admin accounts

Insecure protocols

Protocols that send traffic in the clear: Telnet, FTP, SMTP, IMAP, POP3, HTTP

Secure protocol alternatives

SSH, SFTP, HTTPS, and other encrypted versions

Checking for insecure protocols

Perform a packet capture (e.g. Wireshark). If you can read the data, like browser version, referral URLs, and cookies over HTTP, it's unencrypted

Wall of Sheep

Display at DEF CON that shows email addresses, partial passwords, and IP addresses captured from attendees using insecure protocols on the wireless network

Default credentials

Factory username and password on a device. Many devices never force you to change them

Mirai botnet

Open source botnet that checks over 60 default credential configurations for IoT devices (cameras, routers, doorbells, garage door openers) and takes over any it finds

Open ports

Each inbound service opens a port, giving outsiders some access. Limit open ports

Firewall rule set risk

Large, complex rule sets make it easy to accidentally allow access to an IP or port. Schedule periodic audits of the rule base

Why mobile devices are hard to secure

Small, easy to hide, constantly moving, hold personal and organizational sensitive data, and always connected to the internet

Rooting

Replacing the operating system on an Android device with a third party OS to enable features and bypass security

Jailbreaking

Replacing the operating system on Apple iOS to enable features and bypass security

Effect of rooting or jailbreaking

Circumvents all the security put in place by the organization's mobile device manager

MDM

Mobile Device Manager, used to apply security policies and restrictions to mobile devices

Sideloading

Installing apps from outside approved app stores, often done after rooting or jailbreaking

Malicious mobile apps

A single bad app can expose all data on the device, so MDM or the OS restricts which apps can be installed and from where

AUP

Acceptable Use Policy. Usually forbids unauthorized OS or software installation. Violating it can lead to dismissal

Zero day vulnerability

A vulnerability unknown to the vendor, so no patch exists yet

Zero day attack

An attacker exploiting a vulnerability before the vendor knows about it or has a patch

Why attackers hunt for vulnerabilities

Finding them first lets them exploit systems with no patch available. They don't share findings with vendors

CVE

Common Vulnerabilities and Exposures (cve.mitre.org), a site for tracking known vulnerabilities and zero day attacks

2023 zero day examples

Chrome (April) memory corruption and sandbox escape. Microsoft (May) self signed code running during UEFI boot despite Secure Boot. Apple iOS and iPadOS (May) sandbox escape, sensitive info disclosure, and arbitrary code execution

Malware

Any software that does bad things to your system, such as logging keystrokes, showing ads, infecting files, or encrypting data

Types of malware

Viruses, worms, ransomware, Trojan horses, rootkits, keyloggers, spyware, bloatware, logic bombs

Trojan horse

Software that appears to perform a legitimate function but actually installs malware

Malware working together

Malware types are often combined, e.g. a worm exploits a vulnerability, installs a remote access backdoor, and the attacker uses it to install more malware

How malware gets onto a system

Clicking links or attachments in email, website pop ups, drive by downloads, or worms exploiting known vulnerabilities

Drive by download

Malware downloaded automatically just by visiting a malicious site, without clicking anything

Why malware exists

Data is valuable, whether personal (photos, documents) or organizational (plans, employee info, financials), either on its own or because victims will pay to get it back

Ransomware

Malware that encrypts your personal data and demands payment (usually cryptocurrency) for the decryption key

Ransomware and the operating system

The OS keeps working so the victim can see the attacker's ransom messages, but personal files are inaccessible