Supply Chain, Cryptographic, Misconfiguration, Mobile, and Zero-Day
Unit 4: Vulnerabilities. Lesson 15 of 54 in SecPlus Academy.
The last group of vulnerability classes is about trust: in providers, in algorithms, in defaults, in app stores, and in the assumption that a patch exists.
Supply chain
You inherit the security of everyone you depend on.
- Service provider: a managed service provider or cloud vendor with access to your environment.
- Hardware provider: devices that arrive with compromised firmware or counterfeit parts.
- Software provider: libraries, packages, and applications that ship with backdoors or get poisoned upstream.
Defense: vendor assessment, contractual security requirements, verified and signed software, inventory of components, and monitoring of third-party access.
Cryptographic vulnerabilities
Weak or deprecated algorithms (MD5, SHA-1, DES, RC4), short keys, self-made cryptography, poor random number generation, and protocols that allow downgrade to weaker options. The algorithm may be fine while the implementation or the key handling is broken. Defense: current algorithms, adequate key length, tested libraries, disable legacy protocol versions.
Misconfiguration
The most common vulnerability of all: open ports, default accounts, verbose error messages, permissive file shares, disabled logging, unnecessary services. Defense: secure baselines, configuration management, regular scanning, and change control.
Mobile device vulnerabilities
- Side loading: installing apps from outside the official store bypasses the store's screening.
- Jailbreaking (iOS) and rooting (Android): removing the operating system's protections gives the user, and any malware, full control. Mobile device management can detect and block these devices.
Side loading (also written sideloading) and jailbreaking are the two named mobile risks.
Zero-day
A vulnerability that is being exploited before the vendor has a patch, or before the vendor even knows. There is nothing to install. Defense while waiting: compensating controls such as segmentation, disabling the vulnerable feature, tighter monitoring, and threat intelligence to know it exists.
Supply Chain, Cryptographic, Misconfiguration, Mobile, and Zero-Day, explained slowly
Vulnerabilities of trust
The last five classes are about things you trusted without checking: your providers, your algorithms, your default settings, your app store, and the assumption that someone has already fixed the bug.
Supply chain
Every organization runs on components made by others. Compromise the component and you compromise everyone who uses it.
Service provider an MSP, cloud provider, or contractor with access to your systems Hardware provider devices arriving with compromised firmware or counterfeit parts Software provider libraries, packages, and applications poisoned upstream
A developer adds an open-source library; months later an attacker takes over the library's maintainer account and pushes a version with a backdoor; every build that pulls the update ships the backdoor. Defenses: assess vendors before and during the relationship, require security terms in contracts, verify signatures on software and firmware, keep an inventory of components (a software bill of materials), and monitor what third parties do with their access.
Cryptographic
The algorithm can be perfect and the system still broken.
- Weak or deprecated algorithms: MD5, SHA-1, DES, 3DES, RC4, SSL, TLS 1.0 and 1.1.
- Short keys: RSA 1024, anything that brute force can reach.
- Homemade cryptography: "we wrote our own" almost always means broken.
- Poor randomness: predictable keys from a weak random number generator.
- Downgrade: the protocol allows a fallback to a weak option and an attacker forces it.
Defenses: current algorithms, adequate key lengths, well-tested libraries, disable legacy protocol versions and ciphers.
Misconfiguration
By volume, the most common vulnerability in the world. Nothing is broken; something was set wrong or left at default.
- Open ports and unnecessary services.
- Default accounts and passwords.
- Verbose error messages that reveal versions and paths.
- Directory listing enabled, permissive file shares, world-readable storage.
- Logging disabled, so nothing is noticed.
Defenses: secure baselines applied at build time, configuration management that detects drift, regular scanning, and change control so settings do not quietly change.
Mobile devices
- Side loading: installing an app from outside the official store. The store's review and signature checks are bypassed, so the app can be anything.
- Jailbreaking (iOS) and rooting (Android): removing the operating system's built-in restrictions to gain full control. The user gets freedom; so does every piece of malware, which now runs with the same full control.
Defense: mobile device management that detects jailbroken or rooted devices and blocks them from corporate resources, and policies against side loading.
Zero-day
A zero-day is a vulnerability attackers are exploiting before the vendor has released a patch, sometimes before the vendor knows it exists. The name means the defenders have had zero days to prepare. There is nothing to install.
What you do instead, until the patch arrives:
- Learn about it: threat intelligence feeds, vendor advisories.
- Reduce exposure: disable the vulnerable feature, block the port, segment the affected systems.
- Watch harder: add detection rules for the exploit's behavior.
- Patch the moment it is available.
Those interim measures are compensating controls.
Reading the scenario
"A dependency in the build was replaced by a malicious version" software supply chain "The app uses RC4 and 1024-bit RSA" cryptographic "The camera still uses admin/admin and has directory listing on" misconfiguration "Employees installed an app from a link, not the store" side loading "The phone's OS restrictions were removed by the user" jailbreaking / rooting "Exploit is active and the vendor has no fix yet" zero-day
What to memorize
- Supply chain: service, hardware, software providers; verify and inventory.
- Cryptographic: weak algorithms, short keys, downgrade.
- Misconfiguration: the most common; baselines and drift detection.
- Side loading bypasses the store; jailbreaking removes protections.
- Zero-day: no patch; compensating controls until there is one.