Systems are compromised when an attacker finds a weakness and exploits it. In casual conversation, the terms vulnerability, exploit, attack, and threat are often used as though they were interchangeable, but they have distinct meanings. A vulnerability is a weakness. An exploit is a technique that takes advantage of a vulnerability. An attack is a deliberate attempt to compromise a system. A threat is any circumstance or event with the potential to cause harm, so threats include adversaries, accidents, equipment failures, and natural events.

A security incident is an event that actually or potentially jeopardizes a security property or violates a security policy. A data breach is a more specific term. It refers to an incident involving unauthorized access to data or the disclosure of data. An availability failure can therefore be a serious security incident without being a data breach.

Vulnerabilities

A vulnerability is a weakness in a system that could allow a security property to fail. A bug is a defect in hardware or software. Some bugs create vulnerabilities, but vulnerabilities can also arise from weaknesses in a design, misconfigurations, or human error. An adversary may exploit a vulnerability, or an accident or routine event may expose it.

Several categories of vulnerabilities appear repeatedly:

• A program trusts input it should have validated. Data arrives that is longer or different than the program was written to expect. It then ends up somewhere it does not belong, such as memory that the program never reserved for it. The family of memory-corruption bugs belongs here.

• A system ships in an insecure state and no one modifies it. For example, the administrator password on a router may still be the one printed in the manual, a database may be accessible from the Internet with authentication disabled, or a debugging interface may remain enabled in production.

• A protocol was designed without an attacker in mind. Every implementation may be correct while the design still permits interception or impersonation. There is no defect to repair in that situation. The specification is the vulnerability and must be updated.

• A cryptographic algorithm or key size becomes obsolete. The algorithm itself does not change, but computers become faster and researchers may discover shortcuts. A key length that was adequate when the system was built can become insecure over time.

Vulnerabilities also exist in hardware. Spectre and Meltdown, disclosed in January 2018, exploited side effects of speculative execution, a performance technique in which a processor begins work before it knows whether that work will be needed. Even when the processor discards the result, changes left in its cache can reveal which data it touched. Meltdown allowed a program to infer protected kernel memory on affected processors. Spectre manipulated other software into touching data that should have remained inaccessible.

Rowhammer, published in 2014, exploits the physical behavior of dynamic random access memory (DRAM). Repeated access to one row can cause electrical interference that flips bits in an adjacent row. These hardware vulnerabilities arose from mechanisms that make hardware fast and dense, so remedies have required a mixture of software isolation, firmware changes, and redesigned hardware.

Log4j is a logging library used in many Java applications. Its vulnerability became known as Log4Shell, and it showed how rapidly risk can change. Vulnerable versions treated parts of logged text as lookup instructions. In affected configurations, attacker-controlled text could cause the library to fetch and execute remote code.

The library was deployed so widely that the vulnerability proved difficult to contain. It often arrived several layers down inside other software. For many defenders, the first problem was determining whether they were running it at all.

Exploits

An exploit is the tool, code, or technique used to take advantage of a vulnerability. The distinction is important. A vulnerability is a property of the system, while an exploit is something someone creates to take advantage of that weakness.

A large family of exploits operates on the same underlying principle: the attacker supplies data, and the program treats that data as instructions.

Three common examples are:

1. A program that assembles a database query by inserting user input into a string can be given input that terminates the query and then appends another one after it.

2. A page that displays a visitor’s comment to other visitors without validating it can be handed a comment containing code, and that code then executes in those visitors’ browsers.

3. A program that passes user input to a shell can be given input carrying a second command.

These three are known as SQL injection, cross-site scripting, and command injection. All three share the same root cause: the program does not cleanly separate data from instructions. We will look at these and related injection attacks later.

Two names associated with exploits frequently appear in articles:

1. EternalBlue targeted a vulnerability in an older version of Microsoft’s Windows file-sharing protocol. The U.S. National Security Agency (NSA) developed the exploit. Microsoft patched the vulnerability in March 2017, before a group known as the Shadow Brokers publicly released EternalBlue in April. WannaCry used it to spread the following month.

2. Metasploit is a framework that bundles many known exploits so that testers can use them with authorization. It can also be misused to carry out attacks.

Vulnerabilities and exploits are distinct. There can be a long gap between when a vulnerability is introduced and when someone figures out how to exploit it. A vulnerability may exist in code for years before anyone discovers a practical way to use it.

Attacks

An attack is a deliberate attempt to gain unauthorized access or to compromise confidentiality, integrity, availability, authenticity, or another security property. An attack may use a software exploit, stolen credentials, or social engineering. Many attacks combine several methods in sequence.

The terms below are common in security discussions. They mix objectives and methods. Some describe what the attacker wanted, while others describe how the attacker operated. Most incidents involve several of these at once.

• Ransomware encrypts data, or otherwise disables access to it, and then demands payment for restoration. It began as a nuisance targeting individual users. It has since become an industry with negotiators, affiliates, and support operations.

• Extortion uses a threat, such as publishing stolen data, to demand payment or another concession. Exfiltration, which was mentioned earlier, is the act of removing data. The threat and the demand are what transform the incident into extortion.

• Double extortion combines encryption with a threat to publish stolen data. The Maze group popularized the model in late 2019 by releasing documents from a company that had refused to pay. An organization with reliable backups may be able to restore encrypted files, although no backup can unpublish a document. Attackers increasingly omit encryption because copying data is quieter and avoids the effort of deploying a reliable encryptor. Resilience, a cyber insurer, reported that 65% of the extortion claims it handled in the second half of 2025 involved no encryption.

• Denial of service renders a system unusable by exhausting a finite resource, such as bandwidth, connections, memory, or the attention of the people responding. Some denial-of-service attacks instead exploit a bug that causes the target to crash or become disabled.

• Resource hijacking runs the attacker’s software on someone else’s computer. The target is the machine rather than the data it holds. Compromised computers mine cryptocurrency, and they relay traffic so that it appears to originate from an ordinary residential address rather than a data center. They are also assembled into networks that carry out the attacks described above. One such relay network, 911 S5, was dismantled in 2024. Its compromised devices had been associated with more than 19 million unique IP addresses, and its operator had earned roughly $99 million.

• Impersonation uses stolen or forged credentials to act as another party. Credential stuffing is one such technique. Usernames and passwords from an earlier breach are replayed automatically against unrelated sites, and enough people reuse passwords to make the effort profitable.

• Social engineering targets the person rather than the software. Someone with legitimate access is convinced to use it on the attacker’s behalf.

Attack Vectors

An attack vector is the path or method used to gain access or produce an effect. A vector describes how an attack begins. Common vectors include the following:

• Email attachments carrying malicious macros or embedded objects.

• Websites hosting drive-by downloads or exploiting browser vulnerabilities.

• USB devices carrying malicious files, exploiting device-handling vulnerabilities, or impersonating a keyboard or network adapter.

• Networks, where open ports and unpatched services are directly reachable.

Attack Surface

An attack surface is the sum of the points where an attacker could attempt to gain entry. The more services, interfaces, and users a system exposes, the more opportunities an attacker has. The points that make up a surface vary with the system, and they are not all technical:

• A public website with multiple APIs and login pages.

• A corporate network with open ports and remote access endpoints.

• Employees who are reachable by email.

Many defenses address individual vulnerabilities as they are found. Reducing the attack surface takes another approach by removing or disabling components the system does not need. An attacker cannot reach a network service that is not running.

Big by Default

Identifying the complete attack surface is difficult. Much of what runs on a machine was not chosen by the person operating it. Unix and Linux distributions once shipped with many network services installed and enabled by default, including mail transfer, remote login, file sharing, and print spooling.

Reducing this exposure by removing unused software, disabling unnecessary services, closing ports, and changing insecure defaults is called hardening. Hardening begins with an inventory of what the system runs and then removes what the system does not need.

The Ramen worm exploited this habit in January 2001. It carried attacks against three services that Red Hat Linux enabled by default: a print spooler, a file-locking service, and an FTP server. Patches had been available for months. A machine could be exposed even when its owner had never used the affected feature.

Vendors eventually reversed the default. Sun offered a Secure by Default configuration for Solaris, and current server distributions usually enable only a small set of network services. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, now urges vendors to ship secure configurations and provide loosening guides that explain the risk of turning features back on. This moves the burden from the administrator who has to find everything to disable to the person choosing what to enable.

Surfaces You Choose

In March 2021, Microsoft disclosed a set of vulnerabilities in Exchange Server, the mail server that organizations install and run on their own hardware. The vulnerabilities allowed an attacker to access the server without an account and leave software behind on it. Attackers had been using them since early January, and within a week of the March 2 patch, at least 10 unrelated groups were doing the same.

Every vulnerable server was one that an organization had chosen to run itself. RiskIQ, a firm that inventories Internet-facing systems, counted about 400,000 on-premises Exchange servers needing the update when it shipped, and about 82,000 still unpatched nine days later. Microsoft’s hosted mail service was not affected. An organization could patch its server, or move to a hosted service and decommission it, thereby removing the surface entirely. The second option transfers trust and risk to the provider rather than eliminating them. The attack surface disappears locally but is present at the service provider. The company is betting that the service provider does a better job with keeping software patched and enforcing security controls.

Forgotten Surfaces

An attack surface also includes what an organization has forgotten it has. In November 2023, a password-spraying attack succeeded against a legacy Microsoft test account. That account had no multi-factor authentication because it predated the policy that required it.

The account itself held nothing of value. What it provided was a foothold. From there, the attackers found a legacy test application that still had elevated permissions in the production environment. Taking control of it allowed them to grant themselves mailbox access. They read email belonging to Microsoft’s senior leadership and its cybersecurity and legal staff for about seven weeks before being detected. In January, the company stated that source code repositories had not been reached. In March, it added that they had.

Microsoft’s response demonstrates the scale of the underlying problem. The company deleted 6.9 million unused and aging tenants. It now assigns temporary non-production tenants a default lifetime of 90 days.

Isolation

Hardening removes the parts of a surface a system does not need. Organizations with especially sensitive data go further and separate the system from its surroundings. The controls that do this are usually physical rather than technical.

An air gap eliminates direct network connectivity between a protected system and outside networks. The definition is stricter than “not on the Internet.” Transfers across the boundary require a controlled physical process. Air gaps reduce the number of available paths, although they do not eliminate them all. For example, removable media, maintenance equipment, supply chains, radio interfaces, and insiders can still cross the boundary.

A Sensitive Compartmented Information Facility (SCIF) extends isolation to a room used for handling compartmented intelligence. Personal electronic devices are prohibited, the walls must prevent conversations from being understood outside, and some rooms are shielded against radio emissions. The rules address every path information could take out of the room, including paths other than the network.

Isolation still depends on people and procedures. Iran’s uranium enrichment facility at Natanz was air gapped, and malicious software still reached it. The route has never been publicly established, although removable media is the leading explanation.

Vulnerabilities in AI Systems

Software built around machine learning models introduces failure modes beyond those already present in conventional software. We will cover AI security issues in detail later, but the following three failures are examples of how models can be corrupted and how attackers can abuse models that integrate with other tools.

1. The Training Data Is Part of the System

A model’s behavior comes only partly from conventional source code. Much of it is encoded in parameters learned from training data, so an attacker who corrupts that data can change the model without adding malicious code. In 2020, the researchers behind MetaPoison altered 0.5% of an image-training set and caused the resulting model to misclassify a chosen image more than 15% of the time.

2. A Capability Without Its Original Safeguards

Safeguards can disappear when an agent receives a capability previously held by a person. Meta permitted an AI-assisted support tool to initiate Instagram password resets, but one path failed to verify that the supplied email address matched the account. Attackers used ordinary-language requests to redirect reset links, and Meta reported that 20,225 people were affected between April 17 and May 31, 2026.

3. Prompt Injection

Prompt injection supplies an agent with text that it treats as an instruction rather than as content. In the indirect form, the text arrives inside material the agent was asked to process, such as a document, a web page, or an email. The problem resembles injection vulnerabilities in conventional software. Current language-model systems, however, lack a reliable boundary between instructions and untrusted natural-language data. Meta’s missing check was an ordinary account-recovery defect. Prompt injection is a distinct failure mode, and it becomes dangerous when a model can take consequential actions.

The Human Factor

Attackers often bypass strong technical controls by targeting a person or a neglected process. A forgotten service, a rushed configuration, or an employee facing a persuasive caller may provide less resistance than the cryptography.

Social engineering manipulates, deceives, or influences people into giving up information or access. The attacker convinces someone with legitimate access to open the door. People can also be bribed or persuaded to misuse access they already have. A convincing phone call is often cheaper than discovering a new vulnerability.

In March 2011, an employee at RSA, a company that sold two-factor authentication tokens, opened an Excel attachment titled “2011 Recruitment plan.” The file exploited an unpatched Adobe Flash vulnerability and gave the attackers remote control. They reached a server holding the secret values used to generate codes on SecurID hardware tokens and spent about nine hours copying them to a rented server.

RSA’s parent company reported $66 million in remediation costs. Two months later, Lockheed Martin detected an intrusion that used material from the breach. An authentication product used by tens of millions of people had been compromised through one spreadsheet attachment.

Humans are part of the attack surface, and annual awareness training is not enough. Organizations also need verification procedures, recovery paths that resist impersonation, and a clear way to report suspicious requests. Deception is only one route. An attacker may also bribe, blackmail, or recruit someone who already has access.

Bribery appears frequently in SIM swapping, an attack that redirects a victim’s phone number to a SIM card controlled by the attacker. The attacker then receives the victim’s calls and text messages, including codes sent to confirm logins. Between October 20 and November 9, 2018, a sales representative at an American mobile carrier accepted twelve payments totaling about $2,325 to carry out unauthorized transfers affecting at least 19 customers. The court ordered him to pay $77,417.50 in restitution.

Awareness training cannot prevent an employee from accepting a bribe. Controls that limit what one employee can do alone and record sensitive actions address that risk.

Honest Mistakes

Security controls limit accidental damage in addition to attacks. Not every loss involves an attacker. Some losses are caused by people with legitimate access who click the wrong item, run the wrong command, or trust a script.

The three properties of the CIA triad apply to those people too:

• Confidentiality fails when a person opens a file they were never meant to see or sends a spreadsheet to a mailing list instead of to a colleague.

• Integrity fails when a person updates the wrong rows of a database or restores an old copy over the current work.

• Availability fails when someone deletes a directory that a service requires, or when a backup everyone assumed was running turns out not to have been.

The same controls that stop attackers also reduce accidental damage. Permissions that allow only what is needed limit both intentional and accidental access. Logs that record changes make errors traceable. Tested backups make recovery possible.

Resource limits address availability in the same way. Without them, a user can write a program that consumes all the CPU time or fills the disk. An ordinary defect can produce the same result without anyone intending it.

Threats and Threat Actors

A threat is a situation or event with the potential to harm a system. Some threats are adversarial, while others may be accidents, equipment failures, and natural events. A threat actor, also known as a threat agent, is a person, group, organization, or state that might carry out an adversarial threat.

A standard taxonomy in the security literature divides threats into four classes:

• Disclosure refers to gaining unauthorized access to information. Data breaches and eavesdropping both fall under this category.

• Deception involves treating false data as true, for example via forged logs, spoofed identities, or tampered sensor readings. The victim may then act on the false data, causing additional damage.

• Disruption refers to the interruption or degradation of correct operation.

• Usurpation refers to taking control of a system without authorization through malware, privilege escalation, or session hijacking.

These classes describe the effect of a threat rather than the technique used. One action may fit several classes. Altering a routing table, for example, can deceive users about where traffic is going, disrupt communication, and give the attacker control over the traffic. The classification depends on the effect being analyzed.

The Internet as a Risk Amplifier

The Internet’s protocols were designed in the 1970s, when protection against hostile use was not a primary goal. Connecting a system now exposes it to untrusted parties around the world.

Eight of its properties operate in an attacker’s favor, and they compound one another:

Action at a distance

An attack does not require physical presence. Someone on another continent can reach a server as readily as someone in the adjacent room, without the risks of entering a building or standing near the target.

Anonymity and obfuscation

The address observed by the victim does not have to belong to the attacker. Traffic can be relayed through other machines, and we will look at methods for doing so later. Each relay may sit in a different country, and attackers can leave misleading technical or linguistic clues.

Global reach

The attacker, victim, relays, and money may all be in different countries. Different laws and limits on cooperation slow an investigation. Determining who carried out an action is called attribution, and the Internet makes it one of the hardest problems in security.

Automation at scale

An attack can be written once and attempted against millions of systems. Even a low success rate can produce many victims. In 2021, Palo Alto Networks found that scanning for newly disclosed vulnerabilities often began within 15 minutes.

Shared code

The same operating systems, libraries, and products run on millions of machines. A vulnerability in one shared component creates many potential targets at once.

Asymmetric force

An attacker can bring more force to bear than the attacker owns, and more than most defenders can absorb. One person can send fraudulent messages to millions of recipients for almost nothing, and a small group can attempt to disrupt a corporation or a government. Botnets, introduced in Part 1, make this cheap: the renter of a botnet directs an attacking force they never had to build. Scale alone can overwhelm a well-resourced defender. In 2010, the U.S. Deputy Secretary of Defense reported that the department operated 15,000 networks and seven million computing devices, and that its networks were probed thousands of times every day.

Asymmetric effort

A defender must protect every reachable path, while an attacker needs only one that works. This imbalance does not depend on the attacker’s skill or budget, and improving a defense does not remove it.

Traffic that looks legitimate (lack of distinction)

An attacker logging in and an authorized user logging in send the same kinds of packets. The difference lies in who is acting and why, information the network traffic does not state directly.

One early incident put most of these properties on display at once, and the response to it shaped how the Internet handles security problems today.

On November 2, 1988, a Cornell graduate student released a self-propagating program from an MIT machine chosen to conceal its origin. A bug caused it to reinfect machines and slow them to a halt. In less than a day, the Morris worm reached an estimated 6,000 of the roughly 60,000 hosts then connected to the Internet. We will return to the worm later when dealing with malware.

After the attack, the Defense Advanced Research Projects Agency (DARPA) asked Carnegie Mellon University’s Software Engineering Institute to establish the Computer Emergency Response Team (CERT) to coordinate incident response across organizations. It still operates as the CERT Coordination Center, and many countries and companies use the same model. The worm’s author became the first person convicted under the Computer Fraud and Abuse Act (CFAA), the 1986 U.S. law that makes it a federal crime to access a computer without authorization or beyond what the owner permits.

Botnets

A botnet, introduced in Part 1, is a collection of compromised machines under the control of one attacker. Its devices receive instructions through command-and-control (C2) infrastructure. Some botnets use central servers, which law enforcement can seize. Others use peer-to-peer communication, rotating domains, or compromised web services to avoid a single point of failure. Their members are often cameras, routers, and printers rather than conventional computers.

Building a botnet and using one are separate businesses. One group breaks into devices and maintains the collection. Another rents it for spam, phishing, credential stuffing, cryptocurrency mining, or denial-of-service attacks. The renter needs neither the skill to compromise the devices nor knowledge of which devices are involved.

Next: Part 3: Adversaries

Lecture 1: Part 1 | Part 2 | Part 3 | Part 4
Lecture 1 Study Guide | List of terms