syssec_red_book

4.1. What Is the Problem?infrastructure. A thorough discussion of the most commonly used attacks andexploitation techniques is provided in the SysSec Deliverable D7.1: Review ofthe State-of-the-Art in Cyberattacks [373].4.1 What Is the Problem?Despite significant advances in software protection and attack mitigationtechniques, exploitable vulnerabilities are continuously being discovered evenin the latest versions of widely used applications, programming libraries,operating systems, online services, embedded software, and other programs.For instance, the exploitation of memory corruption vulnerabilities in serverand client applications has been one of the most prevalent means of systemcompromise and malware infection. Recent prominent examples include inthe-wildexploits against Internet Explorer [33], Adobe Flash Player [6], andAdobe Reader [5, 101], all capable of successfully bypassing the data executionprevention (DEP) and address space layout randomization (ASLR) protectionsof Windows [279], even on the most recent and fully updated (at the time ofpublic notice) systems.As secure programming, software protections, and exploit mitigation mechanismshave become more widely employed, successful compromise mightrequire the combined exploitation of multiple vulnerabilities on the samesystem. A recent exploit against the Chrome browser required a chain of sixdifferent vulnerabilities to successfully break out of the Chrome sandbox andachieve arbitrary remote code execution [304].Besides arbitrary code execution, other possible outcomes with less freedomof choice for the attacker, but probably of equal severity, include disclosureor modification of private data, privilege escalation, logic errors, denial ofservice, and other unauthorized actions. Indicatively, a memory corruptionvulnerability may allow the modification of critical application data, includinguser identity, configuration, user input, and decision-making information [124].Privilege escalation attacks are an important threat in multi-user environmentsor multi-tenant cloud services, as they can allow less-privileged usersto gain root access and compromise other users and the system itself. Theproliferation of mobile operating systems such as iOS and Android, in whichthird-party applications run with lower privileges, has made privilege escalationattacks particular relevant, as they can allow malicious applications togain unrestricted access to a user’s device.The shift towards web services and cloud-based applications has also givenrise to a multitude of web-specific attacks that exploit vulnerabilities anywherebetween a client’s browser and a server’s back-end systems. The exploitationof SQL injection, XSS, CSRF, and other more subtle types of application flawsin web services can lead to the disclosure of massive amounts of private29