What is a software vulnerability and why are there so many?

Recently, the WannaCry ransomware took control of hundreds of thousands of computers around the world by taking advantage of flaws in the Windows operating system and attacking computers equipped with this platform and spread rapidly; But what exactly does this action mean? Considering hackers as thieves and malicious software as their theft tools can help us answer this question.

By researching cybercrime and the use of technology among criminals for more than a decade, it is clear that these individuals are looking for ways to penetrate computers and networks, and are using a wide variety of options to get into their target systems.

What is a software vulnerability and why are there so many?

Some thieves may simply choose the direct method and enter it through the main door of the desired location; While others tend to be more stealthy and try to open the lock or use a door that is left open to enter their place of theft. This situation is also true for hackers; However, cybercriminals have more ways to penetrate their targets’ systems.

Weaknesses that hackers use are not like broken windows or rusty door hinges; Instead, they take advantage of software flaws in programs that run on computers. Since the creation of programs is the responsibility of humans, it can be expected that there will be defects in them. It’s almost impossible to create completely flawless software, which means that there are always ways for cyber attackers.

Simply put, a vulnerability can be an error in system management or a flaw in the code and how to respond to certain requests. Common vulnerabilities allow hackers to perform SQL injection attacks. This method is used in websites that use query-based databases to display information. In this situation, the attacker creates a query that contains code in the SQL database programming language.

If the website is not properly secured, its search functionality can execute malicious SQL statements and this flaw helps an attacker gain access to the database and potentially control the website. Similarly, many users use software compatible with the Java programming language, including Flash Player and Android applications.

There are numerous vulnerabilities in the Java platform, all of which can be exploited in different ways. The usual method in these types of programs is to force users to download plugins or in-program codecs. These add-ons actually contain malicious code that exploits the vulnerability of the program and endangers the security of the user’s device.

There are vulnerabilities in all types of software. Several versions of Microsoft’s Windows operating system contained bugs that WannaCry used to attack its targets. For example, the popular open source web browser Firefox has identified more than 100 vulnerabilities in its code every year since 2009. In addition, since early 2017, about 15 bugs have been identified in Microsoft’s Internet Explorer browser.

Software development is not a perfect process. Developers often work to timelines set by management teams and try to set reasonable goals, which can be problematic as a result of meeting these deadlines. Developers make every effort to design products safely when building applications; But it is possible that they will not succeed in identifying all the defects before the set date.

It is possible that some delays in the release of programs will result in high costs for the companies that make them. Many companies release the initial version of the product and after identifying the problems, they fix them by providing security updates. These updates are sometimes known as software patches; Because their goal is to fix the weaknesses of the programs.

It should be said that software companies cannot support their products forever; Because in order to continue working, they have to focus on improving the programs and selling newer versions; So after some time they don’t provide new software updates for their older apps. When an attacker discovers a new vulnerability in software, he can develop a new program that uses the bug to gain access to the target system and take control of it.

Cyber ​​thieves try to penetrate target systems by discovering weaknesses in them, including network security vulnerabilities. If the attackers can communicate with the target computer, they can take approaches to increase their access, such as accessing specific files or running specific programs.

In recent years, hackers have repeatedly taken advantage of vulnerabilities in web browsers, tools that allow them to connect to the Internet and run small programs. Browsers have many vulnerabilities that can be exploited. These bugs allow hackers to control the target computer and as a result, they can use this level of access to infiltrate more sensitive and larger networks.

Sometimes, software developers or security researchers report these vulnerabilities to the companies that make them. Sometimes, hackers or government spy agencies discover how to break into systems; But they don’t inform the manufacturer. These types of bugs are called “zero day vulnerability”; Because the software developer did not have time to fix them, and as a result, that software or hardware will be at risk until the release of the security patch.

One of the best ways to stay secure is for users to install software updates regularly. Next, you can see the list of 50 software with the highest number of vulnerabilities detected: