book

Hacking the Hacker

by Roger A. Grimes

May 2017

Beginner

320 pages

6h 47m

English

Wiley

Audiobook available

Read now

Unlock full access

Most Hackers Aren’t GeniusesDefenders Are Hackers PlusHackers Are SpecialHackers Are PersistentHacker Hats
The Secret to HackingHacking Ethically
For More Information on Bruce Schneier
Social Engineering MethodsSocial Engineering Defenses
For More Information on Kevin Mitnick
Number of Software VulnerabilitiesWhy Are Software Vulnerabilities Still a Big Problem?Defenses Against Software VulnerabilitiesPerfect Software Won’t Cure All Ills

For More Information on Michael Howard
For More Information on Gary McGraw
Malware TypesNumber of Malware ProgramsMostly Criminal in OriginDefenses Against Malware
For More Information on Susan Bradley
For More on Mark Russinovich
What Is Cryptography?Why Can’t Attackers Just Guess All the Possible Keys?Symmetric Versus Asymmetric KeysPopular CryptographyHashesCryptographic UsesCryptographic Attacks
For More Information on Martin Hellman
Traits of a Good Security Event MessageAdvanced Persistent Threats (APTs)Types of Intrusion DetectionIntrusion Detection Tools and Services
For More Information on Dr. Dorothy E. Denning
For More Information on Michael Dubinsky
What Is a Firewall?
For More Information on William Cheswick
What Is a Honeypot?InteractionWhy Use a Honeypot?Catching My Own Russian SpyHoneypot Resources to Explore
For More Information on Lance Spitzner
Authentication ComponentsHacking PasswordsPassword Defenses
For More Information on Dr. Cormac Herley
The Wireless WorldTypes of Wireless HackingSome Wireless Hacking ToolsWireless Hacking Defenses
For More Information on Thomas d’Otreppe de Bouvette
My Penetration Testing HighlightsHow to Be a Pen Tester
For More Information on Aaron Higbee
For More Information on Benild Joseph
Types of DDoS AttacksDDoS Tools and ProvidersDDoS Defenses
For More Information on Brian Krebs
How to Secure an Operating SystemSecurity Consortiums
For More Information on Joanna Rutkowska
For More Information on Aaron Margosis
Types of Network AttacksNetwork Attack Defenses
For More Information on Laura Chappell
How Do Hackers Hack IoT? IoT Defenses
For More Information on Dr. Charlie Miller
StandardsPoliciesProceduresFrameworksRegulatory LawsGlobal ConcernsSystems Support
For More Information on Jing de Jong‐Chen
Why Threat Model?Threat Modeling ModelsThreat Actors
For More Information on Adam Shostack
Computer Security Training TopicsTraining Methods
For More Information on Stephen Northcutt
Privacy OrganizationsPrivacy‐Protecting Applications
For More Information on Eva Galperin
Patching FactsCommon Patching Problems
For More Information on Window Snyder
Computer Security Writing OutletsProfessional Writing Tips
For More Information on Fahmida Y. Rashid
Signs Your Kid Is HackingNot All Hacking Is BadHow to Turn Around Your Malicious Hacker
Hacker Code of Ethics

Content preview from Hacking the Hacker

6Software Vulnerabilities

Software vulnerabilities are susceptible weaknesses (i.e. “bugs”) in software, often from exploitable flaws written by the developer or inherent in the programming language. Not every software bug is a security vulnerability. The bug must be exploitable by an attacker to become a threat or risk. Most software bugs cause an operational issue (which may not even directly manifest themselves to the operator) or even cause a fatal interruption to processing but cannot be leveraged by an attacker to gain unauthorized system access.

Exploitable software vulnerabilities are responsible for a large (if not the largest) percentage of hacking in a given time period, even though other hacking methods (such as Trojan horse programs and social engineering) are often very competitive. Some computer security experts think most computer security issues would go away if all software was bug‐free, although this isn’t true or possible. Still, even if not a panacea, more secure code with fewer vulnerabilities would wipe a significant category of hacking issues out and make our computing environment appreciably safer.

Number of Software Vulnerabilities

There are many sources for tracking public software vulnerabilities, although the bugs listed for each may vary significantly. On average, each year, major software developers and bug finders publicly announce 5000–6000 new software vulnerabilities. That’s about 15 bugs per day, day after day. The Common Vulnerabilities ...