Jump to content

Vulnerability (computer security)

From Wikipedia, the free encyclopedia
(Redirected fromSecurity vulnerability)
Part of a series on
Computer hacking
History
Hacker cultureandethic
Conferences
Computer crime
Hacking tools
Practice sites
Malware
Computer security
Groups
Publications

Vulnerabilitiesare flaws in a computer system that weaken the overall security of the system.

Despite intentions to achieve complete correctness, virtually all hardware and software contains bugs where the system does not behave as expected. If the bug could enable an attacker to compromise the confidentiality, integrity, or availability of system resources, it is called a vulnerability. Insecuresoftware developmentpractices as well as design factors such as complexity can increase the burden of vulnerabilities. There are different types most common in different components such as hardware, operating systems, and applications.

Vulnerability managementis a process that includes identifying systems and prioritizing which are most important, scanning for vulnerabilities, and taking action to secure the system. Vulnerability management typically is a combination of remediation (fixing the vulnerability), mitigation (increasing the difficulty or reducing the danger of exploits), and accepting risks that are not economical or practical to eliminate. Vulnerabilities can be scored for risk according to theCommon Vulnerability Scoring Systemor other systems, and added to vulnerability databases. As of 2023,there are more than 20 million vulnerabilities catalogued in theCommon Vulnerabilities and Exposures(CVE) database.

A vulnerability is initiated when it is introduced into hardware or software. It becomes active and exploitable when the software or hardware containing the vulnerability is running. The vulnerability may be discovered by the vendor or a third party. Disclosing the vulnerability (as apatchor otherwise) is associated with an increased risk of compromise because attackers often move faster than patches are rolled out. Regardless of whether a patch is ever released to remediate the vulnerability, its lifecycle will eventually end when the system, or older versions of it, fall out of use.

Causes

[edit]

Despite developers' goal of delivering a product that works entirely as intended, virtually allsoftwareandhardwarecontains bugs.[1]If a bug creates a security risk, it is called a vulnerability.[2][3][4]Software patchesare often released to fix identified vulnerabilities, but those that remain unknown (zero days) as well as those that have not been patched are still liable for exploitation.[5]Vulnerabilities vary in their ability to beexploitedby malicious actors,[2]and the actual risk is dependent on the nature of the vulnerability as well as the value of the surrounding system.[6]Although some vulnerabilities can only be used fordenial of serviceattacks, more dangerous ones allow the attacker toinjectand run their own code (calledmalware), without the user being aware of it.[2]Only a minority of vulnerabilities allow forprivilege escalation,which is necessary for more severe attacks.[7]Without a vulnerability, the exploit cannot gain access.[8]It is also possible formalwareto be installed directly, without an exploit, if the attacker usessocial engineeringor implants the malware in legitimate software that is downloaded deliberately.[9]

Design factors

[edit]

Fundamental design factors that can increase the burden of vulnerabilities include:

  • Complexity: Large, complex systems increase the probability of flaws and unintendedaccess points.[10]
  • Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw.[11]
  • Connectivity: any system connected to the internet can be accessed and compromised.Disconnecting systems from the internetis one truly effective measure against attacks, but it is rarely feasible.[12]
  • Legacy softwareandhardwareis at increased risk, but upgrading often is prohibitive in terms of cost anddowntime.[13]

Development factors

[edit]

Somesoftware developmentpractices can affect the risk of vulnerabilities being introduced to a code base. Lack of knowledge about secure software development or excessive pressure to deliver features quickly can lead to avoidable vulnerabilities to enter production code, especially if security is not prioritized by thecompany culture.This can lead to unintended vulnerabilities. The more complex the system is, the easier it is for vulnerabilities to go undetected. Some vulnerabilities are deliberately planted, which could be for any reason from a disgruntled employee selling access to hackers, to sophisticated state-sponsored schemes to introduce vulnerabilities to software.[14]Inadequatecode reviewscan lead to missed bugs, but there are alsostatic code analysistools that can be used as part of code reviews and may find some vulnerabilities.[15]

DevOps,a development workflow that emphasizes automated testing and deployment to speed up the deployment of new features, often requires that many developers be granted access to change configurations, which can lead to deliberate or inadvertent inclusion of vulnerabilities.[16]Compartmentalizing dependencies, which is often part of DevOps workflows, can reduce theattack surfaceby paring down dependencies to only what is necessary.[17]Ifsoftware as a serviceis used, rather than the organization's own hardware and software, the organization is dependent on the cloud services provider to prevent vulnerabilities.[18]

National Vulnerability Database classification

[edit]

TheNational Vulnerability Databaseclassifies vulnerabilities into eight root causes that may be overlapping, including:[19]

  1. Input validation(includingbuffer overflowandboundary condition) vulnerabilities occur wheninput checkingis not sufficient to prevent the attacker from injecting malicious code.[20]
  2. Access controlvulnerabilities enable an attacker to access a system that is supposed to be restricted to them, or engage inprivilege escalation.[20]
  3. When the system fails to handle and exceptional or unanticipated condition correctly, an attacker can exploit the situation to gain access.[21]
  4. Aconfiguration vulnerabilitycomes into existence when configuration settings cause risks to the system security, leading to such faults as unpatched software or file system permissions that do not sufficiently restrict access.[21]
  5. Arace condition—when timing or other external factors change the outcome and lead to inconsistent or unpredictable results—can cause a vulnerability.[21]

Vulnerabilities by component

[edit]

Hardware

[edit]
Main article:Hardware security bug

Deliberate security bugs can be introduced during or after manufacturing and cause theintegrated circuitnot to behave as expected under certain specific circumstances. Testing for security bugs in hardware is quite difficult due to limited time and the complexity of twenty-first century chips,[22]while the globalization of design and manufacturing has increased the opportunity for these bugs to be introduced by malicious actors.[23]

Operating system

[edit]
See also:Operating system § Security

Althoughoperating system vulnerabilitiesvary depending on theoperating systemin use, a common problem isprivilege escalationbugs that enable the attacker to gain more access than they should be allowed.Open-sourceoperating systems such asLinuxandAndroidhave a freely accessiblesource codeand allow anyone to contribute, which could enable the introduction of vulnerabilities. However, the same vulnerabilities also occur in proprietary operating systems such asMicrosoft WindowsandApple operating systems.[24]All reputable vendors of operating systems provide patches regularly.[25]

Client–server applications

[edit]

Client–server applicationsare downloaded onto the end user's computers and are typically updated less frequently than web applications. Unlike web applications, they interact directly with a user'soperating system.Common vulnerabilities in these applications include:[26]

Web applications

[edit]

Web applicationsrun on many websites. Because they are inherently less secure than other applications, they are a leading source ofdata breachesand other security incidents.[27][28]Common types of vulnerabilities found in these applications include:

Management

[edit]
Main article:Vulnerability management

There is little evidence about the effectiveness and cost-effectiveness of different cyberattack prevention measures.[31]Although estimating the risk of an attack is not straightforward, the mean time to breach and expected cost can be considered to determine the priority for remediating or mitigating an identified vulnerability and whether it is cost effective to do so.[32]Although attention to security can reduce the risk of attack, achieving perfect security for a complex system is impossible, and many security measures have unacceptable cost or usability downsides.[33]For example, reducing the complexity and functionality of the system is effective at reducing theattack surface.[34]

Successful vulnerability management usually involves a combination of remediation (closing a vulnerability), mitigation (increasing the difficulty, and reducing the consequences, of exploits), and accepting some residual risk. Often adefense in depthstrategy is used for multiple barriers to attack.[35]Some organizations scan for only the highest-risk vulnerabilities as this enables prioritization in the context of lacking the resources to fix every vulnerability.[36]Increasing expenses is likely to havediminishing returns.[32]

Remediation

[edit]

Remediation fixes vulnerabilities, for example by downloading asoftware patch.[37]Software vulnerability scannersare typically unable to detect zero-day vulnerabilities, but are more effective at finding known vulnerabilities based on a database. These systems can find some known vulnerabilities and advise fixes, such as a patch.[38][39]However, they have limitations includingfalse positives.[37]

Vulnerabilities can only be exploited when they are active-the software in which they are embedded is actively running on the system.[40]Before the code containing the vulnerability is configured to run on the system, it is considered a carrier.[41]Dormant vulnerabilities can run, but are not currently running. Software containing dormant and carrier vulnerabilities can sometimes be uninstalled or disabled, removing the risk.[42]Active vulnerabilities, if distinguished from the other types, can be prioritized for patching.[40]

Mitigation

[edit]

Vulnerability mitigation is measures that do not close the vulnerability, but make it more difficult to exploit or reduce the consequences of an attack.[43]Reducing theattack surface,particularly for parts of the system withroot(administrator) access, and closing off opportunities for exploits to engage inprivilege exploitationis a common strategy for reducing the harm that a cyberattack can cause.[37]If a patch for third-party software is unavailable, it may be possible to temporarily disable the software.[44]

Testing

[edit]

Apenetration testattempts to enter the system via an exploit to see if the system is insecure.[45]If a penetration test fails, it does not necessarily mean that the system is secure.[46]Some penetration tests can be conducted with automated software that tests against existing exploits for known vulnerabilities.[47]Other penetration tests are conducted by trained hackers. Many companies prefer to contract out this work as it simulates an outsider attack.[46]

Vulnerability lifecycle

[edit]
Vulnerability timeline

The vulnerability lifecycle begins when vulnerabilities are introduced into hardware or software.[48]Detection of vulnerabilities can be by the software vendor, or by a third party. In the latter case, it is considered most ethical to immediately disclose the vulnerability to the vendor so it can be fixed.[49]Government or intelligence agencies buy vulnerabilities that have not been publicly disclosed and may use them in an attack, stockpile them, or notify the vendor.[50]As of 2013, theFive Eyes(United States, United Kingdom, Canada, Australia, and New Zealand) captured the plurality of the market and other significant purchasers included Russia, India, Brazil, Malaysia, Singapore, North Korea, and Iran.[51]Organized criminal groups also buy vulnerabilities, although they typically preferexploit kits.[52]

Even vulnerabilities that are publicly known or patched are often exploitable for an extended period.[53][54]Security patches can take months to develop,[55]or may never be developed.[54]A patch can have negative effects on the functionality of software[54]and users may need totestthe patch to confirm functionality and compatibility.[56]Larger organizations may fail to identify and patch all dependencies, while smaller enterprises and personal users may not install patches.[54]Research suggests that risk of cyberattack increases if the vulnerability is made publicly known or a patch is released.[57]Cybercriminals canreverse engineerthe patch to find the underlying vulnerability and develop exploits,[58]often faster than users install the patch.[57]

Vulnerabilities become deprecated when the software or vulnerable versions fall out of use.[49]This can take an extended period of time; in particular, industrial software may not be feasible to replace even if the manufacturer stops supporting it.[59]

Assessment, disclosure, and inventory

[edit]

Assessment

[edit]

A commonly used scale for assessing the severity of vulnerabilities is the open-source specificationCommon Vulnerability Scoring System(CVSS). CVSS evaluates the possibility to exploit the vulnerability and compromise data confidentiality, availability, and integrity. It also considers how the vulnerability could be used and how complex an exploit would need to be. The amount of access needed for exploitation and whether it could take place without user interaction are also factored in to the overall score.[60][61]

Disclosure

[edit]

Someone who discovers a vulnerability may disclose it immediately (full disclosure) or wait until a patch has been developed (responsible disclosure,or coordinated disclosure). The former approach is praised for its transparency, but the drawback is that the risk of attack is likely to be increased after disclosure with no patch available.[62]Some vendors paybug bountiesto those who report vulnerabilities to them.[63][64]Not all companies respond positively to disclosures, as they can cause legal liability and operational overhead.[65]There is no law requiring disclosure of vulnerabilities.[66]If a vulnerability is discovered by a third party that does not disclose to the vendor or the public, it is called azero-day vulnerability,often considered the most dangerous type because fewer defenses exist.[67]

Vulnerability inventory

[edit]

The most commonly used vulnerability dataset isCommon Vulnerabilities and Exposures(CVE), maintained byMitre Corporation.[68]As of 2023,it has over 20 million entries.[38]This information is shared into other databases, including the United States'National Vulnerability Database,[68]where each vulnerability is given a risk score usingCommon Vulnerability Scoring System(CVSS),Common Platform Enumeration(CPE) scheme, andCommon Weakness Enumeration.[citation needed]CVE and other databases typically do not track vulnerabilities insoftware as a serviceproducts.[38]Submitting a CVE is voluntary for companies that discovered a vulnerability.[66]

Liability

[edit]

The software vendor is usually not legally liable for the cost if a vulnerability is used in an attack, which creates an incentive to make cheaper but less secure software.[69]Some companies are covered by laws, such asPCI,HIPAA,andSarbanes-Oxley,that place legal requirements on vulnerability management.[70]

References

[edit]
  1. ^Ablon & Bogart 2017,p. 1.
  2. ^abcAblon & Bogart 2017,p. 2.
  3. ^Daswani & Elbayadi 2021,p. 25.
  4. ^Seaman 2020,pp. 47–48.
  5. ^Daswani & Elbayadi 2021,pp. 26–27.
  6. ^Haber & Hibbert 2018,pp. 5–6.
  7. ^Haber & Hibbert 2018,p. 6.
  8. ^Haber & Hibbert 2018,p. 10.
  9. ^Haber & Hibbert 2018,pp. 13–14.
  10. ^Kakareka, Almantas (2009). "23". In Vacca, John (ed.).Computer and Information Security Handbook.Morgan Kaufmann Publications. Elsevier Inc. p. 393.ISBN978-0-12-374354-1.
  11. ^Krsul, Ivan (April 15, 1997).Technical Report CSD-TR-97-026.The COAST Laboratory Department of Computer Sciences, Purdue University.CiteSeerX10.1.1.26.5435.
  12. ^Linkov & Kott 2019,p. 2.
  13. ^Haber & Hibbert 2018,p. 155.
  14. ^Strout 2023,p. 17.
  15. ^Haber & Hibbert 2018,p. 143.
  16. ^Haber & Hibbert 2018,p. 141.
  17. ^Haber & Hibbert 2018,p. 142.
  18. ^Haber & Hibbert 2018,pp. 135–137.
  19. ^Garg & Baliyan 2023,pp. 17–18.
  20. ^abGarg & Baliyan 2023,p. 17.
  21. ^abcGarg & Baliyan 2023,p. 18.
  22. ^Salmani 2018,p. 1.
  23. ^Salmani 2018,p. 11.
  24. ^Garg & Baliyan 2023,pp. 20–25.
  25. ^Sharp 2024,p. 271.
  26. ^abcStrout 2023,p. 15.
  27. ^abcdStrout 2023,p. 13.
  28. ^Haber & Hibbert 2018,p. 129.
  29. ^abcdeStrout 2023,p. 14.
  30. ^Strout 2023,pp. 14–15.
  31. ^Agrafiotiset al.2018,p. 2.
  32. ^abHaber & Hibbert 2018,pp. 97–98.
  33. ^Tjoaet al.2024,p. 63.
  34. ^Tjoaet al.2024,pp. 68, 70.
  35. ^Magnusson 2020,p. 34.
  36. ^Haber & Hibbert 2018,pp. 166–167.
  37. ^abcHaber & Hibbert 2018,p. 11.
  38. ^abcStrout 2023,p. 8.
  39. ^Haber & Hibbert 2018,pp. 12–13.
  40. ^abHaber & Hibbert 2018,p. 84.
  41. ^Haber & Hibbert 2018,p. 85.
  42. ^Haber & Hibbert 2018,pp. 84–85.
  43. ^Magnusson 2020,p. 32.
  44. ^Magnusson 2020,p. 33.
  45. ^Haber & Hibbert 2018,p. 93.
  46. ^abHaber & Hibbert 2018,p. 96.
  47. ^Haber & Hibbert 2018,p. 94.
  48. ^Strout 2023,p. 16.
  49. ^abStrout 2023,p. 18.
  50. ^Libicki, Ablon & Webb 2015,p. 44.
  51. ^Perlroth 2021,p. 145.
  52. ^Libicki, Ablon & Webb 2015,pp. 44, 46.
  53. ^Ablon & Bogart 2017,p. 8.
  54. ^abcdSood & Enbody 2014,p. 42.
  55. ^Strout 2023,p. 26.
  56. ^Libicki, Ablon & Webb 2015,p. 50.
  57. ^abLibicki, Ablon & Webb 2015,pp. 49–50.
  58. ^Strout 2023,p. 28.
  59. ^Strout 2023,p. 19.
  60. ^Strout 2023,pp. 5–6.
  61. ^Haber & Hibbert 2018,pp. 73–74.
  62. ^"Ask an Ethicist: Vulnerability Disclosure".Association for Computing Machinery's Committee on Professional Ethics.17 July 2018.Retrieved3 May2024.
  63. ^O'Harrow 2013,p. 18.
  64. ^Libicki, Ablon & Webb 2015,p. 45.
  65. ^Strout 2023,p. 36.
  66. ^abHaber & Hibbert 2018,p. 110.
  67. ^Strout 2023,p. 22.
  68. ^abStrout 2023,p. 6.
  69. ^Sloan & Warner 2019,pp. 104–105.
  70. ^Haber & Hibbert 2018,p. 111.

Sources

[edit]
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Vulnerability_(computer_security)&oldid=1248998051"