vulnerability computing exploitable weakness in a computer system this article is part of a series oninformation security related security categories internet security cyberwarfare computer security mobile security network security threats computer crime vulnerability eavesdropping malware spyware ransomware trojans viruses worms rootkits bootkits keyloggers screen scrapers exploits backdoors logic bombs payloads denial of service defenses computer access control application security antivirus software secure coding secure by default secure by design secure operating systems authentication multifactor authentication authorization datacentric security encryption firewall intrusion detection system mobile secure gateway runtime application selfprotection rasp vte this article is part of a series oncomputer hacking history phreaking cryptovirology hacking of consumer electronics list of hackers hacker culture ethic hacker manifesto black hat grey hat white hat hackerspace hackathon hacktivism maker culture conferences black hat briefings chaos communication congress def con hackers on planet earth computer crime crimeware list of computer criminals script kiddie hacking tools security os vulnerability exploit payload social engineering practice sites hackthissite zoneh malware rootkit backdoor trojan horse virus worm spyware ransomware logic bomb botnet keystroke logging antivirus software firewall hids computer security application security network security groups chaos computer club homebrew computer club defunct legion of doom defunct masters of deception defunct red and blue teams publications 2600 the hacker quarterly hacker news nuts and volts phrack vte in computer security a vulnerability is a weakness which can be exploited by a threat actor such as an attacker to perform unauthorized actions within a computer system to exploit a vulnerability an attacker must have at least one applicable tool or technique that can connect to a system weakness in this frame vulnerability is also known as the attack surface vulnerability management is the cyclical practice of identifying classifying remediating and mitigating vulnerabilities this practice generally refers to software vulnerabilities in computing systems a security risk is often incorrectly classified as a vulnerability the use of vulnerability with the same meaning of risk can lead to confusion the risk is the potential of a significant impact resulting from the exploit of a vulnerability then there are vulnerabilities without risk for example when the affected asset has no value a vulnerability with one or more known instances of working and fully implemented attacks is classified as an exploitable vulnerabilitya vulnerability for which an exploit exists the window of vulnerability is the time from when the security hole was introduced or manifested in deployed software to when access was removed a security fix was availabledeployed or the attacker was disabledsee zeroday attack security bug security defect is a narrower concept there are vulnerabilities that are not related to software hardware site personnel vulnerabilities are examples of vulnerabilities that are not software security bugs constructs in programming languages that are difficult to use properly can be a large source of vulnerabilities definitions iso 27005 defines vulnerability as a weakness of an asset or group of assets that can be exploited by one or more threats where an asset is anything that has value to the organization its business operations and their continuity including information resources that support the organizations mission ietf rfc 2828 define vulnerability as a flaw or weakness in a systems design implementation or operation and management that could be exploited to violate the systems security policy the committee on national security systems of united states of america defined vulnerability in cnss instruction no 4009 dated 26 april 2010 national information assurance glossary vulnerabilityweakness in an information system system security procedures internal controls or implementation that could be exploited by a threat source many nist publications define vulnerability in it context in different publications fismapedia give a broader one a flaw or weakness in system security procedures design implementation or internal controls that could be exercised accidentally triggered or intentionally exploited and result in a security breach or a violation of the systems security policy enisa defines vulnerability in as the existence of a weakness design or implementation error that can lead to an unexpected undesirable event compromising the security of the computer system network application or protocol involveditsec the open group defines vulnerability in as the probability that threat capability exceeds the ability to resist the threat factor analysis of information risk fair defines vulnerability as the probability that an asset will be unable to resist the actions of a threat agent according fair vulnerability is related to control strength ie the strength of a control as compared to a standard measure of force and the threat capabilities ie the probable level of force that a threat agent is capable of applying against an asset isaca defines vulnerability in risk it framework as a weakness in design implementation operation or internal control data and computer security dictionary of standards concepts and terms authors dennis longley and michael shain stockton press isbn0935859179 defines vulnerability as 1 in computer security a weakness in automated systems security procedures administrative controls internet controls etc that could be exploited by a threat to gain unauthorized access to information or to disrupt critical processing 2 in computer security a weakness in the physical layout organization procedures personnel management administration hardware or software that may be exploited to cause harm to the adp system or activity 3 in computer security any weakness or flaw existing in a system the attack or harmful event or the opportunity available to a threat agent to mount that attack matt bishop and dave bailey give the following definition of computer vulnerability a computer system is composed of states describing the current configuration of the entities that make up the computer system the system computes through the application of state transitions that change the state of the system all states reachable from a given initial state using a set of state transitions fall into the class of authorized or unauthorized as defined by a security policy in this paper the definitions of these classes and transitions is considered axiomatic a vulnerable state is an authorized state from which an unauthorized state can be reached using authorized state transitions a compromised state is the state so reached an attack is a sequence of authorized state transitions which end in a compromised state by definition an attack begins in a vulnerable state a vulnerability is a characterization of a vulnerable state which distinguishes it from all nonvulnerable states if generic the vulnerability may characterize many vulnerable states if specific it may characterize only one national information assurance training and education center defines vulnerability a weakness in automated system security procedures administrative controls internal controls and so forth that could be exploited by a threat to gain unauthorized access to information or disrupt critical processing 2 a weakness in system security procedures hardware design internal controls etc which could be exploited to gain unauthorized access to classified or sensitive information 3 a weakness in the physical layout organization procedures personnel management administration hardware or software that may be exploited to cause harm to the adp system or activity the presence of a vulnerability does not in itself cause harm a vulnerability is merely a condition or set of conditions that may allow the adp system or activity to be harmed by an attack 4 an assertion primarily concerning entities of the internal environment assets we say that an asset or class of assets is vulnerable in some way possibly involving an agent or collection of agents we write vie where e may be an empty set 5 susceptibility to various threats 6 a set of properties of a specific internal entity that in union with a set of properties of a specific external entity implies a risk 7 the characteristics of a system which cause it to suffer a definite degradation incapability to perform the designated mission as a result of having been subjected to a certain level of effects in an unnatural manmade hostile environment vulnerability and risk factor models a resource either physical or logical may have one or more vulnerabilities that can be exploited by a threat agent in a threat action the result can potentially compromise the confidentiality integrity or availability of resources not necessarily the vulnerable one belonging to an organization andor other parties involved customers suppliers the socalled cia triad is the basis of information security an attack can be active when it attempts to alter system resources or affect their operation compromising integrity or availability a passive attack attempts to learn or make use of information from the system but does not affect system resources compromising confidentiality owasp relationship between threat agent and business impact owasp see figure depicts the same phenomenon in slightly different terms a threat agent through an attack vector exploits a weakness vulnerability of the system and the related security controls causing a technical impact on an it resource asset connected to a business impact the overall picture represents the risk factors of the risk scenario information security management system a set of policies concerned with information security management the information security management system isms has been developed to manage according to risk management principles the countermeasures in order to ensure the security strategy is set up following the rules and regulations applicable in a country these countermeasures are also called security controls but when applied to the transmission of information they are called security services classification vulnerabilities are classified according to the asset class they are related to hardware susceptibility to humidity susceptibility to dust susceptibility to soiling susceptibility to unprotected storage software insufficient testing lack of audit trail design flaw network unprotected communication lines insecure network architecture personnel inadequate recruiting process inadequate security awareness physical site area subject to flood unreliable power source organizational lack of regular audits lack of continuity plans lack of security causes complexity large complex systems increase the probability of flaws and unintended access points familiarity using common wellknown code software operating systems andor hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw connectivity more physical connections privileges ports protocols and services and time each of those are accessible increase vulnerability password management flaws the computer user uses weak passwords that could be discovered by brute force fundamental operating system design flaws the operating system designer chooses to enforce suboptimal policies on userprogram management for example operating systems with policies such as default permit grant every program and every user full access to the entire computer internet website browsing some internet websites may contain harmful spyware or adware that can be installed automatically on the computer systems after visiting those websites the computer systems become infected and personal information will be collected and passed on to third party individuals software bugs the programmer leaves an exploitable bug in a software program the software bug may allow an attacker to misuse an application unchecked user input the program assumes that all user input is safe programs that do not check user input can allow unintended direct execution of commands or sql statements known as buffer overflows sql injection or other nonvalidated inputs not learning from past mistakes the research has shown that the most vulnerable point in most information systems is the human user operator designer or other human so humans should be considered in their different roles as asset threat information resources social engineering is an increasing security concern vulnerability consequences the impact of a security breach can be very high the fact that it managers or upper management can easily know that it systems and applications have vulnerabilities and do not perform any action to manage the it risk is seen as a misconduct in most legislations privacy law forces managers to act to reduce the impact or likelihood of that security risk information technology security audit is a way to let other independent people certify that the it environment is managed properly and lessen the responsibilities at least having demonstrated the good faith penetration test is a form of verification of the weakness and countermeasures adopted by an organization a white hat hacker tries to attack an organizations information technology assets to find out how easy or difficult it is to compromise the it security the proper way to professionally manage the it risk is to adopt an information security management system such as isoiec 27002 or risk it and follow them according to the security strategy set forth by the upper management one of the key concept of information security is the principle of defence in depth ie to set up a multilayer defence system that can prevent the exploit detect and intercept the attack find out the threat agents and prosecute them intrusion detection system is an example of a class of systems used to detect attacks physical security is a set of measures to protect physically the information asset if somebody can get physical access to the information asset it is quite easy to make resources unavailable to its legitimate users some sets of criteria to be satisfied by a computer its operating system and applications in order to meet a good security level have been developed itsec and common criteria are two examples vulnerability disclosure responsible disclosure many now refer to it as coordinated disclosure because the first is a biased word of vulnerabilities is a topic of great debate as reported by the tech herald in august 2010 google microsoft tippingpoint and rapid7 have recently issued guidelines and statements addressing how they will deal with disclosure going forward a responsible disclosure first alerts the affected vendors confidentially before alerting cert two weeks later which grants the vendors another 45day grace period before publishing a security advisory full disclosure is done when all the details of vulnerability is publicized perhaps with the intent to put pressure on the software or procedure authors to find a fix urgently well respected authors have published books on vulnerabilities and how to exploit them hacking the art of exploitation second edition is a good example security researchers catering to the needs of the cyberwarfare or cybercrime industry have stated that this approach does not provide them with adequate income for their efforts instead they offer their exploits privately to enable zero day attacks the never ending effort to find new vulnerabilities and to fix them is called computer insecurity in january 2014 when google revealed a microsoft vulnerability before microsoft released a patch to fix it a microsoft representative called for coordinated practices among software companies in revealing disclosures vulnerability inventory mitre corporation maintains a list of disclosed vulnerabilities in a system called common vulnerabilities and exposures where vulnerability are classified scored using common vulnerability scoring system cvss owasp collects a list of potential vulnerabilities with the aim of educating system designers and programmers therefore reducing the likelihood of vulnerabilities being written unintentionally into the software vulnerability disclosure date the time of disclosure of a vulnerability is defined differently in the security community and industry it is most commonly referred to as a kind of public disclosure of security information by a certain party usually vulnerability information is discussed on a mailing list or published on a security web site and results in a security advisory afterward the time of disclosure is the first date a security vulnerability is described on a channel where the disclosed information on the vulnerability has to fulfill the following requirement the information is freely available to the public the vulnerability information is published by a trusted and independent channelsource the vulnerability has undergone analysis by experts such that risk rating information is included upon disclosure identifying and removing vulnerabilities many software tools exist that can aid in the discovery and sometimes removal of vulnerabilities in a computer system though these tools can provide an auditor with a good overview of possible vulnerabilities present they can not replace human judgment relying solely on scanners will yield false positives and a limitedscope view of the problems present in the system vulnerabilities have been found in every major operating system including windows macos various forms of unix and linux openvms and others the only way to reduce the chance of a vulnerability being used against a system is through constant vigilance including careful system maintenance eg applying software patches best practices in deployment eg the use of firewalls and access controls and auditing both during development and throughout the deployment lifecycle examples of vulnerabilities vulnerabilities are related to physical environment of the system the personnel management administration procedures and security measures within the organization business operation and service delivery hardware software communication equipment and facilities and their combinations it is evident that a pure technical approach cannot even protect physical assets one should have administrative procedure to let maintenance personnel to enter the facilities and people with adequate knowledge of the procedures motivated to follow it with proper care see social engineering security four examples of vulnerability exploits an attacker finds and uses an overflow weakness to install malware to export sensitive data an attacker convinces a user to open an email message with attached malware an insider copies a hardened encrypted program onto a thumb drive and cracks it at home a flood damages ones computer systems installed at ground floor software vulnerabilities common types of software flaws that lead to vulnerabilities include memory safety violations such as buffer overflows and overreads dangling pointers input validation errors such as code injection crosssite scripting in web applications directory traversal email injection format string attacks http header injection http response splitting privilegeconfusion bugs such as clickjacking crosssite request forgery in web applications ftp bounce attack privilege escalation race conditions such as symlink races timeofchecktotimeofuse bugs sql injection sidechannel attack timing attack user interface failures such as blaming the victim prompting a user to make a security decision without giving the user enough information to answer it race conditions warning fatigue or user conditioning some set of coding guidelines have been developed and a large number of static code analysers has been used to verify that the code follows the guidelines computer security portal browser security computer emergency response team information security internet security mobile security vulnerability scanner security advisories links from the open directory httpwwwdmozorgcomputerssecurityadvisoriesandpatches 