Cyberstudy
PDF p.225 In progress

Application Vulnerabilities

Open PDF at p.225 17 flashcards

Summary

PDF p.225

Application vulnerabilities include race conditions, memory injection, buffer overflow, and malicious updates. These vulnerabilities can lead to severe security breaches, unauthorized access, data corruption, and system compromises.

In plain words

Supplementary — not from your PDF

Application flaws include race conditions and TOCTOU (time-of-check to time-of-use), where the timing of events can be abused; memory injection, where malicious code is placed into a running process; buffer overflows, where writing beyond a buffer can overwrite a return address; and malicious updates, where a trusted update channel delivers harmful code (CCleaner, SolarWinds). Defenses include locks and semaphores, input validation, secure coding, ASLR and DEP, memory-safe languages, application testing, and verifying update signatures.

Detailed explanation

PDF p.225
  • Race Condition and TOCTOU
    • Definition: Software flaws related to the timing or order of events within a program.
    • Impact: Can cause data corruption, unauthorized access, or security breaches.
    • Examples
      • Dirty COW (CVE-2016-5195): A race condition in the Linux Kernel allowing privileged access.
      • Microsoft Windows Elevation of Privilege (CVE-2020-0796): A race condition in SMBv3 protocol allowing arbitrary code execution.
    • Mitigation: Use of locks, semaphores, and monitors in multi-threaded applications.
  • Memory Injection
    • Definition: Introducing malicious code into a running application's process memory.
    • Impact: Can lead to unauthorized access, malware installation, data exfiltration, or creating backdoors.
    • Common Attacks: Buffer overflow, format string vulnerabilities, code injection.
    • Mitigation: Secure coding practices, input/output validation, encoding, type-casting, access controls, static and dynamic application testing.
  • Buffer Overflow
    • Definition: Exploiting a buffer by overfilling it with data.
    • Impact: Can change the return address in the stack, allowing arbitrary code execution.
    • Mitigation: Address space layout randomization (ASLR), Data Execution Prevention (DEP), type-safe programming languages, secure coding practices.
  • Malicious Update
    • Definition: An update that appears legitimate but contains harmful code.
    • Impact: Can distribute malware or execute cyberattacks.
    • Examples
      • CCleaner (2017): Compromised update with a malicious payload.
      • SolarWinds (2020): Malicious update to the Orion platform distributing a backdoor.
    • Mitigation: Secure software supply chain management, digital signature verification, software security practices.

Important terms

taken from the text above
Race Condition and TOCTOU
Software flaws related to the timing or order of events within a program.
Dirty COW (CVE-2016-5195)
A race condition in the Linux Kernel allowing privileged access.
Microsoft Windows Elevation of Privilege (CVE-2020-0796)
A race condition in SMBv3 protocol allowing arbitrary code execution.
Memory Injection
Introducing malicious code into a running application's process memory.
Common Attacks
Buffer overflow, format string vulnerabilities, code injection.
Buffer Overflow
Exploiting a buffer by overfilling it with data.
Malicious Update
An update that appears legitimate but contains harmful code.
CCleaner (2017)
Compromised update with a malicious payload.
SolarWinds (2020)
Malicious update to the Orion platform distributing a backdoor.
ASLR Address space layout randomization DEP Data Execution Prevention

Examples & real-world scenarios

Supplementary — not from your PDF
  • ASLR randomizing memory locations so injected code is harder to target.
  • DEP marking memory regions as non-executable.
  • Checking the digital signature of an update before installing it.

Scenario

A software vendor's build system is compromised and a signed update carries a backdoor to thousands of customers. This is a malicious update. Supply chain security and build integrity checks are the main defenses.

Common mistakes

Supplementary — not from your PDF
  • Thinking a signed update is always safe. Signing proves origin, not that the build wasn't tampered with before signing.
  • Mixing up race conditions (timing) and buffer overflows (memory bounds).

Practical skills

Supplementary — not from your PDF
  • Match each application flaw to its main mitigations.

What I should remember

Key Points PDF p.225
  • Race Condition and TOCTOU
    • Definition: Timing/order flaws.
    • Impact: Data corruption, unauthorized access.
    • Examples: Dirty COW, Microsoft SMBv3.
    • Mitigation: Locks, semaphores, monitors.
  • Memory Injection
    • Definition: Malicious code in process memory.
    • Impact: Unauthorized access, malware, data exfiltration.
    • Common Attacks: Buffer overflow, code injection.
    • Mitigation: Secure coding, validation, access controls.
  • Buffer Overflow
    • Definition: Overfilling a buffer.
    • Impact: Arbitrary code execution.
    • Mitigation: ASLR, DEP, type-safe languages, secure coding.
  • Malicious Update
    • Definition: Harmful code in updates.
    • Impact: Malware distribution, cyberattacks.
    • Examples: CCleaner, SolarWinds.
    • Mitigation: Supply chain management, digital signatures.