Vulnerabilities in Cybersecurity

Vulnerability Handling

• An exploit is often developed to take advantage of a vulnerability, and a vendor cannot fix a vulnerability until they are aware of it.
• Unreported vulnerabilities can remain unfixed for a long time and are referred to as 'zero days' or '0-days'.

Full Disclosure vs. Responsible Disclosure

• There are two approaches to publishing vulnerabilities: full disclosure and responsible disclosure.
• Full disclosure involves publicly disclosing the vulnerability without notifying the vendor in advance, which can put pressure on the vendor to release a fix quickly.
• Responsible disclosure, also known as coordinated disclosure, involves informing the vendor first and giving them a specific timeframe to release a fix before going public.

Responsible Disclosure

• The typical timeframe for responsible disclosure is 90 days, but vendors may request an extension.
• The finder of the vulnerability has the discretion to grant an extension or not.
• Responsible disclosure is not without flaws, and it can increase the effort for system administrators to contact domain owners to resolve problems.

Case Study: Reconnaissance

• Whois is not the only system that leaks information, and attackers can use other systems like the Domain Name System to gather information.
• Reverse DNS lookups can be used to look up hostnames given an IP address.
• Certificate Transparency and Passive DNS can leak sensitive information to attackers, including hostnames of internal systems.
• Port scanners can be used to enumerate all publicly reachable hosts and services.

Case Study: Perimeter Security via Firewalls

• Firewalls can be configured to drop all packets that do not match a list of specific port numbers.
• However, this assumption does not hold, as services can be reconfigured to listen on arbitrary ports.
• Firewalls can be bypassed using ports that are commonly allowed in the firewall's configuration.
• Deep Packet Inspection (DPI) can be used to check if packets contain data for a specific service, but it is an open debate whether DPI is an acceptable practice.

Case Study: Network Intrusion Detection Systems

• Signature-based NIDS detect threats by matching network packets to known attack patterns.
• Anomaly-based NIDS detect deviations from normal communication patterns.
• Neither signature-based nor anomaly-based NIDS can detect all threats, as they are limited to network communication.
• Encrypted traffic cannot be analyzed by NIDS, but this limitation can be overcome by using TLS interception.
• TLS interception has been called into question, as it allows administrators to eavesdrop on encrypted communication.

Evaluating NIDS Accuracy

• The accuracy of a NIDS is evaluated using four metrics: true positive rate, false negative rate, false positive rate, and true negative rate.
• Even very accurate NIDS generate many false positives due to the base rate fallacy.
• The imbalance between false alarms and real alarms is a significant issue in practical NIDS.