System weaknesses
The six common weaknesses of a system and the fix for each: unpatched software, default passwords, needless services, excessive rights, default configuration, privilege escalation; reading a CVE entry and its CVSS score.
- 24 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Attack surface: what is it?
Show the answer
All the points of a system through which an attacker can try to get in: listening services, accounts, interfaces, installed software.
Every open service is code that may contain a flaw: closing what is not needed reduces the number of possible entry points.
Here are the ports listening on a server that only hosts a website. Which line should be removed first?
```bash
$ ss -tln
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 511 0.0.0.0:443 0.0.0.0:*
LISTEN 0 128 0.0.0.0:23 0.0.0.0:*
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*`- Port 23, a Telnet service open on all interfaces
- Port 3306, a database listening on the machine itself
- Port 22, an administration access open on all of the server's interfaces
- Port 443, the website served to all visitors from the Internet
Show the answer
Port 23, a Telnet service open on all interfaces
Telnet has no use on this server and sends everything in clear text. Port 3306 is bound to 127.0.0.1: only the machine itself can connect to it. SSH (22) is for administration, and 443 is the reason the server exists.
A publicly known flaw gets a unique identifier of the form …-2021-44228; its severity is rated from 0 to 10 by the … score.
Show the answer
A publicly known flaw gets a unique identifier of the form CVE-2021-44228; its severity is rated from 0 to 10 by the CVSS score.
The CVE identifier names the flaw unambiguously, whatever the vendor or tool talking about it. The CVSS score helps order the fixes, without replacing an analysis of your own context.
Default credentials: what is it?
Show the answer
The username and password pair set by the maker or vendor, identical on every unit and published in its documentation, such as admin/admin.
Bots try these pairs on every reachable address: a device exposed with its original credentials is compromised within minutes.
A file server has been used for cryptocurrency mining for three days. Its administration interface answers on the Internet with admin/admin. Which measure deals with the cause?
- Change the password and close administration access from the Internet
- Block the mining server's address at the firewall
- Install a second security tool on the file server and keep it up to date
- Restart the server every night to stop the processes
Show the answer
Change the password and close administration access from the Internet
The attackers got in with a pair published by the maker. Blocking the mining pool or restarting only treats the symptom: they will return with the same credentials. You also need to check that no other account or program was added.