Software Vulnerabilities and Disclosure Quiz

A weakness in a software or system that allows malicious actors to exploit it.

Code designed to take advantage of a vulnerability in a system or application.

A type of exploit that takes advantage of a newly discovered vulnerability that vendors are not yet aware of.

The section of a hard drive that contains the instructions for booting the operating system.

A type of malicious software that encrypts user files and demands a ransom for their decryption.

Malware that modifies or corrupts files on a system.

A malicious program that downloads and installs other malware.

Malware that targets specific file extensions.

A type of malware designed to cause damage by overwriting files with a specific pattern (0xCC). This pattern usually makes the file unusable.

A vulnerability in Windows that allows attackers to gain control of a computer by manipulating memory allocation and processing network messages.

The process by which malware spreads from one computer to another through network scanning and exploiting vulnerabilities.

A security patch released by Microsoft to address the EternalBlue vulnerability. It is crucial to update systems with this patch.

A method of protecting systems by disabling the Server Message Block (SMB) protocol, which EternalBlue exploits.

A security measure that prevents vulnerable machines from being exposed to the internet, reducing the risk of attack.

A type of malware that overwrites the Master Boot Record (MBR) of a hard drive, preventing the operating system from loading.

The act of revealing information about a security flaw in software or hardware.

Making information about a vulnerability public, which might encourage vendors to quickly release patches.

Disclosing a vulnerability before patches are widely available could leave companies vulnerable, especially smaller ones.

A software used for surveillance and gathering personal information, such as browsing history.

The idea that disclosing vulnerabilities should only happen after security patches are widely available.

A secure environment that isolates applications and prevents them from affecting the host system or other applications.

A technology used in computer operating systems to limit an application's access to system resources, isolating it from other applications and the host system.

Exploiting vulnerabilities in mobile devices by sending or receiving malicious SMS messages or redirecting users to compromised websites.

A sandbox environment commonly used in Android to isolate applications and prevent them from accessing resources not intended for them.

A mechanism that separates processes based on user groups rather than individual processes.

Using a namespace to separate processes, ensuring even if a program tries to escape its sandbox, it's still isolated.

A more advanced type of sandbox used in FreeBSD that acts like a virtual machine, providing a completely isolated environment for applications.

A security measure that ensures chroot programs with privileges are stripped once they are placed in the sandbox environment.

A completely isolated environment designed to reduce the impact of zero-day exploits by confining them to a separate space.

Each application runs in a separate, isolated container, creating the illusion of a stand-alone system.

A security mechanism that prevents unauthorized changes to the operating system, making it tamper-proof.

Attacks that aim to break out of a container's isolation, allowing attackers to access other parts of the system.

Attacks that exploit vulnerabilities in the dependencies used by a containerized application.

Exploits search for system symbols like current_task and pcpu_base_addr in the kernel's symbol table to gain information about a process and its state.

A technique that isolates processes in containers, but the degree of isolation depends on how the container is implemented.

Docker is a technology that implements containerization by packaging applications with their dependencies in a container, ensuring consistent execution across different environments.