Misconfiguration Vulnerabilities - CompTIA Security+ SY0-701 - 2.3

How Data Exposure Occurs on the Internet

Unsecured Data and Its Risks

• Leaving data unprotected in open areas of the internet is a common vulnerability, often exploited by attackers during reconnaissance.

• Attackers anticipate finding unsecured data, as evidenced by the June 2017 incident where 14 million Verizon records were publicly accessible.

• The exposure occurred due to a third party neglecting security measures on an Amazon S3 repository; fortunately, it was discovered by a researcher.

Admin Account Vulnerabilities

• Unsecured admin accounts pose significant risks; in Linux, this is typically the root account, while Windows uses the administrator account.

• Administrators often set weak passwords for these accounts (e.g., "123456"), making them susceptible to brute force attacks.

• Best practices recommend disabling direct login for admin accounts and using normal user accounts with elevated access instead.

Importance of Secure Protocols

• Encryption methods are ineffective if insecure protocols like Telnet and FTP are used; secure versions must be employed to protect data transmission.

• Packet captures can reveal whether data is being sent securely; HTTP traffic can expose sensitive information easily.

The Consequences of Insecure Network Practices

Monitoring Traffic at Security Conferences

• At DEFCON 22, monitoring tools display unsecured network traffic, revealing sensitive details such as email addresses and partial passwords.

• This practice highlights vulnerabilities associated with transmitting data without encryption, referred to as the "wall of sheep."

Default Credentials in IoT Devices

• Many devices come with default usernames and passwords that remain unchanged, creating easy targets for attackers via botnets like Mirai.

• The Mirai botnet exploits these defaults across various IoT devices (e.g., cameras, routers), allowing unauthorized access.

Opening Ports: A Double-edged Sword

Understanding Firewall Complexity and Security Risks

Importance of Limiting Open Ports

• It is crucial to limit the number of open ports accessible by external entities to enhance security.

• Firewalls are commonly used to manage access to specific port numbers on designated IP addresses, allowing for controlled connectivity.

Challenges with Firewall Management

• The complexity of firewall rule sets can lead to potential security vulnerabilities due to their size.

• There is a risk that firewall administrators may inadvertently grant access to devices that should remain restricted.