Lecture Notes: Cybersecurity Vulnerabilities and Best Practices

Exposing Data on the Internet

• Unsecured Data
  • Leaving sensitive data in open areas of the internet is common.
  • Attackers use unsecured cloud services as a reconnaissance method.
  • Example: In June 2017, 14 million Verizon records were found in an unprotected Amazon S3 repository.
  • Fortunately, a researcher found these records, not an attacker.

Unsecured Admin Accounts

• Administrator Accounts
  • Linux: Root account
  • Windows: Administrator account (Superuser account)
  • Administrators often use weak passwords (e.g., "123456", "ninja").
  • Best Practice: Disable direct login to administrator accounts.
  • Use normal user accounts with elevated access via su or sudo in Linux and "Run as administrator" in Windows.
  • Limit the number of accounts with root/admin access to reduce attack scope.

Protocols and Encryption

• Insecure Protocols
  • Some protocols (Telnet, FTP, SMTP, IMAP) send data unencrypted.
  • Secure versions (SSH, SFTP, HTTPS) should be used.
  • Packet capture can reveal unsecured data (e.g., HTTP shows browser info, cookies, etc.).
• Devcon Security Conference
  • "Wall of Sheep": Insecure protocols are monitored, showing email addresses and passwords in clear text.

Default Credentials in IoT Devices

• Default Usernames and Passwords
  • Many IoT devices come with default credentials and no prompts to change them.
  • Botnets can exploit these defaults (e.g., Marai botnet).
  • Over 60 default configurations targeted, including cameras, routers, etc.
  • Open-source botnets used by both researchers and attackers to find default credential uses.

Managing Network Access

• Open Ports and Firewall Management
  • Opening a port allows external access to a server application.
  • Firewalls manage port access via rule sets.
  • Complex rule sets can introduce security vulnerabilities if misconfigured.
  • Regular firewall audits are recommended to limit open ports and enhance network security.