Introduction to Security Vulnerabilities
Twitter: @0xmchow
Learning Objectives
Copyright By PowCoder代写 加微信 powcoder
• By the end of this week, you will be able to:
• Be exposed to and understand the difference between CVE and CWE
Why Talk About Vulnerabilities Now?
• Terminology and vocabulary
• The issue of vulnerability disclosure is an ongoing debate, one of the
really hard problems in Cyber Security
• Understand why software development is very difficult; all software have bugs but some bugs are worse than others
• Cryptography and Web Security have a lot to do with vulnerabilities
Motivation: How Hard is Software Development?
• Here’s a problem for you: on paper, write a binary search program.
• Recall binary search: find the position of a target value within a sorted list by “comparing the target value to the middle element of the array; if they are unequal, the half in which the target cannot lie is eliminated and the search continues on the remaining half until it is successful or the remaining half is empty.” (Wikipedia)
• A humbling exercise, pitfalls galore including off-by-one errors: https://stackoverflow.com/questions/504335/what-are-the-pitfalls- in-implementing-binary-search
• Thank Jon Bentley via for this https://twitter.com/mattblaze/status/771086675258802176
From and ’s talk “Crypto War II: Updates from the Trenches” at The Eleventh HOPE Conference in NYC, July 2016
Vocabulary: Bug vs Flaw
• Bug – An error that exists in the implementation-level (i.e. only exist in source code); very correctable
• Flaw – An error at a much deeper level, particularly in the design, and likely in the code level; can be very difficult and costly to correct
Vocabulary: Vulnerability
• “A weakness in the computational logic (e.g., code) found in software and some hardware components (e.g., firmware) that, when exploited, results in a negative impact to confidentiality, integrity, OR availability.”
• Source: https://cve.mitre.org/about/terminology.html
• Furthermore: “Examples of vulnerabilities include:
• phf (remote command execution as user “nobody”)
• rpc.ttdbserverd (remote command execution as root)
• world-writeable password file (modification of system-critical data) • default password (remote command execution or other access)
• denial of service problems that allow an attacker to cause a Blue Screen of Death • smurf (denial of service by flooding a network)”
What is CVE?
• Common Vulnerabilities and Exposures (CVE)
• Created in 1999 by MITRE, Coley and
• https://cve.mitre.org/
• A dictionary (not a database) of common names (i.e., CVE Identifiers) for publicly known cybersecurity vulnerabilities
• Free for public download and use
• CVE ID Syntax: CVE prefix + Year +
• Does NOT provide proof of concept (PoC) or exploit!
Arbitrary Digits
Then There is CWE. What is CWE?
• Common Weakness Enumeration
• Also maintained by MITRE
• https://cwe.mitre.org/
• “A formal list of software weakness types created to:
• Serve as a common language for describing software security weaknesses in
• Serve as a standard measuring stick for software security tools targeting these weaknesses.
• Provide a common baseline standard for weakness identification, mitigation, and prevention efforts.”
• Source: https://cwe.mitre.org/about/index.html
architecture, design, or code.
What is CWE? Continued
• Some Common Types of Software Weaknesses: • Buffer Overflows, Format Strings, Etc.
• Structure and Validity Problems
• Common Special Element Manipulations
• Channel and Path Errors
• User Interface Errors
• Pathname Traversal and Equivalence Errors • Authentication Errors
• Resource Management Errors • Insufficient Verification of Data • Code Evaluation and Injection • Randomness and Predictability
What’s the Difference Between CVE and CWE?
• Arguably the best explanation via :
• “CWE: has to do with the vulnerability—not the instance within a product or
• “CVE: has to do with the specific instance within a product or system—not the underlying flaw.”
• Source: https://danielmiessler.com/blog/difference-cve-cwe/
• Example:
• CVE-2015-2213 is a SQL injection vulnerability in WordPress
• CWE-89: Improper Sanitization of Special Elements used in an SQL Command (is the weakness (or flaw) in the code of WordPress that caused CVE-2015- 2213.)
• Source: https://www.veracode.com/blog/2016/08/language-appsec
National Vulnerability Database
• https://nvd.nist.gov/home.cfm
• Maintained by NIST: National Institute of Standards and Technology
• Uses CVE
• Database; contains references to advisories, solutions, and tools
• Example, regarding CVE-2015-2213 (from previous slide): https://nvd.nist.gov/vuln/detail/CVE-2015-2213
Open Sourced Vulnerability Database (OSVDB)
• http://osvdb.org/
• People: attrition.org, H.D. Moore, Rain Forest Puppy,
• DEAD on April 5th 2016, looking for someone to pick it back up
• Open source
• “OSVDB’s goal is to provide accurate and unbiased information about security vulnerabilities in computerized equipment. The OSVDB blog discusses various topics related to vulnerabilities including disclosure, running a vulnerability database (VDB), and more.” (https://blog.osvdb.org/about/)
The Exploit Database
• https://www.exploit-db.com/
• Maintained by Offensive Security
• A CVE compliant archive of exploits and vulnerable software
• “A repository for exploits and proof-of-concepts rather than advisories”
• Source: https://www.exploit-db.com/about/
• Downloadable
• Tool: searchsploit – command line search tool for Exploit-DB
Scanning for Vulnerabilities
• Metasploit
• Many others
Tool: Nikto
• Written by
• Open Source
• Web server scanner “designed to find various default and insecure files, configurations and programs on any type of web server”
• Documentation: https://cirt.net/nikto2-docs/
• Source code: https://github.com/sullo/nikto
• Example: nikto –host
Tool: Nikto (example continued)
Tool: Nessus
• Commercial
• Was open source at one point; closed source in 2005
• “The world’s most widely deployed vulnerability scanner”
• “There are 86731 plugins, covering 38201 unique CVE IDs and 25042 unique Bugtraq IDs.” https://www.tenable.com/plugins/index.php?view=all
• https://www.tenable.com/products/nessus-vulnerability-scanner
• Nessus Home (free): https://www.tenable.com/products/nessus-home
• OpenVAS (Open Vulnerability Assessment System) is a free and open source fork of Nessus
Tool: Nessus (continued)
Tool: Metasploit
• https://www.metasploit.com/
• Source code: https://github.com/rapid7/metasploit-framework
• Written by H.D. Moore
• Acquired by Rapid7 in 2009
• Open-source platform for developing, testing, and using exploit code • Currently has over 1600 exploits, 400 payloads
Tool: Metasploit (continued)
To Ponder: Vulnerability Scanning
• Question: If you do a scan or a penetration test of a system and no vulnerabilities are reported, is that a good thing?
• Source of picture: Graw
The Vulnerability Disclosure Debate
• Vulnerability disclosure – the practice of reporting security bugs or flaws in a computer software or hardware
• Debate has raged on for decades • Options:
• Full disclosure
• No disclosure
• Responsible disclosure
To Ponder: Vulnerability Disclosure
• Question 1: say you have found a known vulnerability on a system or software. How would you disclose the vulnerability and to whom? What could possibly go wrong?
• Question 2: say you have found an unknown vulnerability, a vulnerability not known by the public including companies (a.k.a., zero day), on a system or software. How would you disclose the vulnerability and to whom? What could possibly go wrong?
程序代写 CS代考 加微信: powcoder QQ: 1823890830 Email: powcoder@163.com