- [Narrator] Code execution attacks
are a special class of attacks
where the attacker exploits a vulnerability
in a system that allows the attacker
to run commands on that system.
There are many different ways
that an attacker might gain this foothold on a system,
but it's normally through some resource
that the target system exposes to the world.
For example, a public-facing web server
must expose ports 80 and/or 443 to the world,
and that port provides access
to a web server such as Apache
or Microsoft Internet Information Server.
If an attacker learns of a code execution vulnerability
in that web server software,
the attacker may exploit the vulnerability
on an unpatched server and use it to execute
whatever commands the attacker desires on that system.
This condition where an attacker runs commands
of his or her choice is known as arbitrary code execution.
When the attack takes place from a remote system
it is also known as remote code execution.
Attackers using code execution vulnerabilities
may perform any action they desire on the targeted system.
If the process they trick into running their code
is running with administrative privileges,
they will gain full access to the system.
Some of the actions an attacker might perform
include installing malicious code,
joining the system to a botnet,
stealing sensitive information,
or creating accounts or another backdoor
to use for later access to the system.
There are two simple steps
that you can take to protect your systems
against code execution attacks.
First, when code execution attacks
take place within an application running on a server,
the code executes with the permissions
of that application process.
You should limit that access
as much as possible, running application services
with restricted accounts that follow the principle
of least privilege.
This will limit the damage caused
by a successful code execution attack.
Second, code execution attacks
almost always exploit vulnerabilities
in applications or operating systems.
Many of these vulnerabilities are known
and have existing patches.
Keeping your operating systems
and applications patched is an incredibly important
and effective security control.
For example, Microsoft released this security bulletin
in February 2016.
It describes a remote code execution vulnerability
in Microsoft Office.
Users running systems that do not have this patch applied
are vulnerable to remote code execution.
By taking these two simple steps,
limiting the use of administrative accounts
and applying security updates,
you can keep your systems protected
against code execution vulnerabilities.