Vulnerabilities & Attacks

01Overview

In 1988 the Morris worm exploited flaws in sendmail and finger to infect roughly 6,000 machines, and CERT was founded in response. In 2001 Code Red and Nimda showed how destructive automatic propagation could be. In 2014 Heartbleed leaked memory through OpenSSL’s heartbeat extension; in 2017 WannaCry used EternalBlue to sweep the world.

In 2018 Spectre and Meltdown showed that even speculative execution on the CPU leaks data; in 2021 Log4Shell reminded everyone how universal open-source components are and how fragile the supply chain is; in 2024 the xz backdoor showed how social engineering can reach a maintainer. Defence is layered — memory-safe languages, least privilege, signed dependencies, continuous audit — and it never ends.

02History

1988
The Morris worm
The first large-scale network worm.
2014
Heartbleed
A memory leak in OpenSSL.
2017
WannaCry
Ransomware goes global.
2018
Spectre and Meltdown
CPU side channels.
2021
Log4Shell
An open-source supply-chain crisis.

03Core concepts

Buffer overflow

Writing past an array bound and overwriting adjacent memory.

Injection

Executing untrusted data as code or as a query.

Side channel

Inferring secrets from timing, power draw or cache state.

04Hands-on

Do it once — it beats reading it ten times

Reproduce a classic buffer overflow in a sandboxed VM, then recompile with stack protection and retry

Tick this once you have built it and written down what you learned; the topic is then marked as built.

05Self-check

Say it in your own words first, then open the answer. Whatever you cannot explain is what to review next.

Can you explain "Buffer overflow"?

Writing past an array bound and overwriting adjacent memory.

Can you explain "Injection"?

Executing untrusted data as code or as a query.

Can you explain "Side channel"?

Inferring secrets from timing, power draw or cache state.

What problem did it solve, and why was there nothing better at the time?

Go back to the history section: how was this done before, and what did it cost?

If you had to build it today, how would you break it down?

Use the hands-on task above: write a plan of at most three steps before you start.

06Key people

Robert Tappan Morris

1965 –

Author of the Morris worm; later a researcher in cryptography and distributed systems.

Dan Kaminsky

1964 –

Found fundamental protocol flaws such as DNS cache poisoning.

07Further reading

The Art of ExploitationJon Erickson · 2008
Secure Coding in C and C++Robert Seacord · 2005