VULNERABILITIES AND EXPLOITATION IN COMPUTER SYSTEM – PAST, PRESENT, AND FUTURE

Editor's Notes

• #3: Introduction on the scenario and problem statementPresent the past and present with few casesImpact analysis based on reports gatheredPredict the vulnerabilities that will persist for another decadesConclusions – present the significant of this studies
• #4: Hardware vulnerabilitiesExample: vulnerabilities in switches/router, chips, card, even TPMSoftware vulnerabilitiesFlaws exist in software causing abnormal behaviorWhy focus on software vulnerabilities?Most of hardware vulnerabilities caused by codes @ softwareSupport our argumentPublished by Reuters – German Federal Office for Info. Security (BSI) released report on insecure TPM due to weak link with Win 8.Sifu of TPM – Prof Ahmad-Reza Sadeghi in his lecture in 2011 share the same view on insecure of TPM ("Runtime Attacks: Buffer Overflow and Return-Oriented Programming," System Security Lab, TechnischeUniversitat Darmstadt Presentation Slide for Course Secure, Trusted and Trustworthy Computing, 2011.)Software vulnerabilities exist since human starts coding/systemize manual work with first vulnerability exploited in late 80s known as Morris Worm.
• #8: Microsoft SDL starts with Bill Gates memo to employee stress on important of having Trustworthy Computing (2002) and continues the vision until now (Rashid, 2013) and (Lipner, 2013).Actual program analysis starts by Anderson in 1974Question raised about the integrity of the data… Is it true? How many vulnerabilities exist? What kind of vulnerabilities? What about future?
• #10: Expert agreed with SANS – Passeri and PierluigiSample cases - 600,000 computers were infected by exploiting a vulnerability found in Apple iOS (Symantec Corporation, 2013) and become botnet.
• #11: Four classes of vulnerabilities contributes to 80% of overall vulnerabilities (Positive Research, 2012, and iMPERVA, 2013)These four classes are – SQLi, XSS, Java and C/C++ vulnerabilities (C/C++ stays top 4 for the past 3 decades (Howard, 2010))Based on analysis done on the online vulnerability databases and organization ((MITRE Corporation, 2011), (National Institute of Standards and Technology (NIST), 2013) and (Open Sourced Vulnerability Database (OSVDB), 2013))95% of XSS vulnerabilities carries Common Vulnerability Scoring System (CVSS) base of 4.0 to 6.9. This indicates the impact of this class of vulnerability is ranked within low to medium severity.70% of Java vulnerabilities recorded in most online vulnerabilities databases have CVSS base of 4.0 to 6.9, of which indicates that the severity of this class of vulnerability is yet to be highly criticalSQLi vulnerability class on the other end has an average of 85% of its vulnerabilities given with CVSS base of 7.0 to 10. This shows that most of vulnerabilities within this class are identified as critical and has severe impact to community. This same intensity is shared with C/C++ vulnerabilities, whereby 60% of reported vulnerabilities in this class are ranked with highly critical and severe impact.
• #12: CVSS is NOT the only factors that is used to measure the impact of vulnerabilities and hence justified our prediction (beside the numbers of vulnerabilities released as presented earlier), we also observed on the other factors as well.Market SharesBased on Net Applications.com – 90% OS is dominated by Windows with 30% is still using the obsolete Windows XP. Used of open-sources OS; that is Linux based such as Centos, Ubuntu, Fedora, etc. also plays important roles. And the most effected vulnerabilities is no other than C/C++ - C/C++ is still at the top four in the list.Being the most popular mobile OS, Android, has contributes to the increase of Java and C/C++ overflow vulnerabilities and exploitation (CISCO, 2013), (IBM X-Force, 2013) and (Symantec Corporation, 2013) and this will continue in-parallel with the emergence of mobile computing (Symantec Corporation, 2013) and (McGraw, 2013).Browser used - Used of Chrome and Safari contributes to increase of exploitation on XSS, Java or C/C++ vulnerabilities (Symantec Corp, 2013) – Todays we have more than 60% mobile computer/phone is using either Chrome, Safari, or IE.Java has virtual machine developed to runs java applications and all vulnerabilities will has difficulties to escape from this virtual machine (Oracle Corporation, 2010), (Oracle Corporation, 2012) and (Fritzinger, et al., 1996). Most of Java vulnerabilities can be contaminated and can be prevented from impacting the user. Many of XSS and SQLi vulnerabilities affecting computer systems through invalidated input. Hence, by validating all input, the vulnerabilities can be prevented and therefore reduce its severity impact (Alhazmi, et al., 2006). Whereas, according to Ahmad et. al. 2011, there is no perfect defense from C/C++ overflow vulnerabilities yet which contributes to the persistency of the vulnerability.
• #13: The fantastic four will remains at least another decades due to emerging mobile tech and online system which is yet to mature.With advancement of detection/prevention – there is probability to suppress the vulnerabilities except C/C++ overflowC/C++ overflow vulnerabilities will prevail againFaster and high memory processing is demanded and as of now, only C/C++ successfully implementedIncreasing trend of cloud services and computerize legacy system in utility, transportation, defense, etc
• #14: Shodan – expose devices connected via the netRapid7 (metasploit), Offensive Security and SecurityVulns – exploit database and toolkitC/C++ is regards as the most dangerous becauseC/C++ is embedded in the language it self and is well-known for more than three decades yet to concrete solutionsOthers do have security mechanism/library/etcDevelopers can be trained (SDL by Microsoft)There is yet a substitute to C/C++ as an efficient language and thus it shall be used as the core language of all systems. On top of that, there is lack of defensive and preventive mechanism of C/C++ language. Therefore, C/C++ overflow vulnerabilities will regain its position and it is predict that it shall happen in the near future