Intrusion, Harassment and Conducive Vulnerabilities
Strategies of intrusion and harassment
- Encircling the bandwagon
- Starvation or constriction
- e.g. contaminating, masking or debilitating DNS services used by users
- e.g. debilitating 3rd party jquery server, or peered web services depended upon by application
- Interception
- Intrusion
- Masquerade
- Diversion, redirection
- Overwriting and replacing code
- Detecting exploitable side-effects
- Cross-site communication
- Piggybacking on data structures, streams, requests and headers
- Social engineering
- Trojanware, sleeperware, siphonware
- Overwhelming server resources
- Exploiting Structural vulnerabilities
Vulnerabilities conducive for intrusion and harassment
- Insufficient redundancy to handle load.
- Transparent architecture and structure.
- Predictable responses.
- Unprotected or poorly secured access.
- Unprotected or poorly secured information.
- Unprotected or poorly secured transmission.
- Direct pipeline from access interface to resource.
- Inherent hideouts for intrusion at access interface.
- Vulnerable information and process flow.
- Vulnerable data structure and modeling strategies.
- Vulnerable resource structure.
- Code or architecture with undocumented, unknown but exploitable side-effects.
- Exposed debugging/test mode algorithms.
- Invitingly exposed back doors and Easter eggs.
- Business rules and processes incompatible for security.
No comments:
Post a Comment