There are always Flaws — Malware Development and Exploitation of Control Flow
Planted January 22, 2024
Disclaimer: The Author of the article does not hold any opinions of facts other than computer technology. Everything here is as per my research and may not be fully accurate (although I tried my best). He is a very simple person and a computer nerd so information in this blog must be taken with a pinch of salt.
I have been studying Cyber Security since an early age and know a few things about it till now. My major interest has been in Binary Exploitation which I followed after completing the fundamentals of Web Application Security and eventually got bored. I always found the low levels of computers to be the most fascinating (one of the reasons is less people understand it and consider it to be complex). These interests came with the study of historical attacks like Stuxnet which I recently found and researched about. Although I am still learning the whole flow of the malware (actually worm) execution and the scope they had while running it. These attacks make the computing industry more exciting to explore and understand that everything has some flaws, it’s just the latency of when it is found.
A vulnerability is a flaw in the logic of the development of software which lets the external entity make the software do things that are not intended and unauthorised. When a vulnerability is found, an exploit is developed for the execution of the vulnerability. This can be a script in any programming language that can perform the attack on the vulnerability and perform the nasty things that the attack intended to do.
When the vulnerability is unknown by the vendor of the software and is found by a third party, it’s called the 0day vulnerability. These exploits are extremely dangerous and cause extreme damage if the attack vector is too high especially when it falls in the hands of a malicious person. Now let me state a very personal opinion on the fact about Open-Source software. Proprietary software has its source code hidden and the vendors don’t disclose the source code of the software. This makes the static code analysis difficult (decompilation and disassembly can work but it’s extremely tedious. Given that debugging source code with assembly can be at the next level of complexity). These vendors have security teams that are limited to them and are responsible for the security of the software. On the other hand, Open Source software has its source code disclosed and hence, it’s comparatively easy to spot any flaws in it. Researchers all over the world audit the code and due to this high volume of people working on it, they tend to be more secure. The whole crowd of security researchers prove to be more active than a finite group of security researchers (it’s an absolute common sense) and hence, Open Source software is more secure in that sense.
The Stuxnet was a consolidation of four 0 days of vulnerabilities and is considered to be one of the most sophisticated malware ever created. Stuxnet went on to cause physical damage and was spread over the world due to the aggressive behaviour towards network devices and its uncontrolled nature. A similar worm called the Wannacry was spread due to the EternalBlue which exploited the vulnerability found in SMB running on Windows Operating System.
My Very Personal Thinking: The Cyber Space has a lot of flaws and there have been a lot of efforts to tackle them. No matter how secure something is, it has flaws. The philosophical argument to this I always make is to blame the entropy. Comparing Thermodynamics with development is not the best comparison ever made but the concept of entropy is something I find the most suitable explanation. The fact that developers go on to develop software in a very ordered way decreases the overall entropy, and these flaws creep in the increase it by causing some disorder to it. To create a program with zero errors is to get the system in extreme order and hence, infinite energy would be required to develop it. (This comes since I am a computer nerd and have studied Thermodynamics in my school days).
Now this argument might not be the most perfect and even wrong. But the analogy is something I feel the most awesome and I always adhere to this fact of the impossibility of developing flawless software or even a system.