-: Server and Host Vulnerabilities,
so the first category we're going to talk about here
is Server and Host vulnerabilities.
These are things like missing patches,
unsupported software, whether that's the operating system
or the apps, buffer overflows, privilege escalation,
arbitrary code execution, insecure protocol use,
and debugging modes.
We're going to cover each of those
inside of this lesson.
Now, missing patches is the first one,
and this is one of the most common issues found.
We've talked about this a lot in the course.
There's a vulnerability that's figured out by a bad guy.
Then, Microsoft gets word of it,
or they discover it themself.
They discover a patch for it and they release the patch,
but nobody bothers to patch it, right?
That's the problem here.
You have to have proper patch management
to ensure that you're not missing patches,
because these missing patches, just like I talked about
in the last thing from the data breach survey,
there's things from 1999 that are
still getting exploited today, right?
This one on the screen, for instance,
is from 2009, and it was still found
on a network this year, in 2017.
This is an issue.
You've gotta get your patches together
to have a successful vulnerability measurement program.
This is probably one of the easiest things to fix, though,
because you put them in to your ticket system.
You pass them to the system administrators,
and they will schedule time to patch the system.
The next one is Unsupported Software.
Software vendors are not going
to support software forever and ever and ever,
for the flat fee you paid 'em one time.
Instead, they have an end-of-life date.
Now, after this date, the software manufacturer says,
"We're not supporting it anymore,"
which means we're not going to patch it.
So, any vulnerabilities that are found
after that date, not our problem.
You should have upgraded to a new version, right,
and that's the idea here with unsupported software.
Now, on the screen, I have an example from Microsoft.
If you're looking at modern operating systems,
which Windows Vista, 7, 8, and 10 are considered
modern operating systems, you can see that
Windows Vista has now reached end-of-life, right,
because in April of 2017, which was about six months ago,
they stopped supporting it.
Now, Windows 7, it's going to end-of-life in 2020.
Windows 8, 2023, and Windows 10, 2025,
so your enterprise needs to be aware of these dates,
and if you're using Windows 10 right now,
you've got about eight more years until you're
gonna have to switch over to the next version of Windows.
If you're using Windows Vista,
you should have already switched,
and this is the idea of unsupported software.
This happens not just with operating systems,
but also with with software itself, like the Office suite.
If you want to know what the end-of-life date
is for your software, Google it and you'll figure it out,
but again, Nessus has a lot of that built in,
and so does QualysGuard.
When you do a scan, it will say,
"Hey, you're running XP, you're running 2003,
"those are end-of-life."
They've been end-of-life since 2014.
You need to migrate to something newer.
Buffer Overflows is our next category.
This occurs when an attacker manipulates
the way the program places data into the memory,
and instead of using the amount that's allotted,
they put more in to overflow that memory
and try to run their own program.
A specific type of this is called an integer overflow,
but again, buffer overflow, in general, is the generic term.
Now, if you want to think about this,
think about it like a glass of water.
Your water is, your glass is only made
to hold eight ounces, but you try to put 10 ounces in,
what happens to the extra two ounces?
It ends up all over your table.
Well, the same thing happens here,
in a computer, but instead of going all over the table,
it just goes into the next piece of the buffer,
which then may be run maliciously.
These vulnerabilities tend to exist for a long time,
but they can be corrected by patches,
so if you see a patch for a buffer overflow,
you want to get that corrected.
In 2015, for instance, 85% of the data breaches,
going back to that Verizon Survey,
were caused by buffer overflow attacks,
so this is a very serious category,
and most of the time they're combined
with something like a missing patch.
There's a missing patch, and that patch
was to stop a buffer overflow.
The next thing we have is Privilege Escalation,
and again, this can be combined with some of these others.
They're not just individual categories sometimes.
This can be combined with a buffer overflow,
which may be combined with missing patches.
Privilege escalation occurs when an attacker
upgrades their level of access from a normal user
to the admin or root user on the system.
For example, if you look at CVE-2016-7255,
this was an example of one that was found
in Windows Vista, 2008, Windows 7, Windows 8.1,
Windows 10, and Windows 2016 machines.
Do you run any of those operating systems?
Well, if so, you should check the CVE,
and make sure you're not vulnerable to this attack.
This would allow a kernel-mode driver to be exploited,
and that would allow a local user to become an admin,
and once you're an admin, you can do
whatever you want on the system.
That's why we do privilege escalation as an attacker.
Next, we have arbitrary code execution,
and this is going to allow an attacker
to run software on a targeted victim machine.
Now, this remote code execution is much worse,
because it allows this to occur over a network,
but it's the same idea as arbitrary code execution.
In the example I gave you here,
is when an insecure library was loading,
causing remote code execution, which again,
is a type of arbitrary code execution,
letting the attacker run code on your system.
Insecure Protocol Use is when you're using
older protocols that were not designed for security,
and they're still in use today.
So, give you a couple of examples here.
FTP, File Transfer Protocol,
Telnet, both of those send data in the clear.
SMBv1, we talked with it before with EternalBlue,
that is again an insecure protocol.
You should not be using it.
How about when we start talking about web security?
We'll talk about that again in the future,
but a protocol like SSL is insecure,
and shouldn't be used today.
So, you'll get an Info, or you'll get a Low,
Medium, Critical, whatever that warning
is inside of the report.
You need to look at it, and figure out if we're using FTP,
why can't we use SFTP instead, Secure FTP.
If we're using Telnet, why can't we use SSH,
because that's more secure, and migrate to a new system
that's not going to have those insecure protocols in use.
Debugging Mode, this is the last category.
This one isn't as much of an exploitation perspective,
where they're going to get admin rights
or do some bad stuff on your system,
but usually it's combined with reconnaissance,
and this is where the debugging mode is going
to give you a lot of information to developers,
but it should be turned off once
you go into the deployment mode,
because if I go into a server and you send
debug codes back to me, I can then use those
to figure out information about your systems,
and then do things like arbitrary code execution,
or remote code execution, and so therefore,
you want to make sure those debugging modes are off.
If Nessus or QualysGuard finds the debugging mode is on,
it will tell you as part of the Info,
as one of those Info Categories or Informational Categories,
and it will inform you, and then you can decide
whether or not to remediate it, which you should.