Is penetration testing becoming objectively "harder" as apps/protocols/operating systems become more secure?

Question

I am currently enrolled in Offensive Security's "Penetration Testing with Kali" course, which is aimed at newcomers to penetration testing. The course is great, with many examples/exercises, and a great virtual lab environment which allows me to connect via VPN and practice everything we've been learning.

One thing which I have noticed is that many of the vulnerabities we've been studying/practicing have been on older e.g. Windows XP/2003 systems, older Linux versions, or have been relying on misconfigured systems (which, if configured correctly, would be much more secure) or protocols which are known to have serious flaws in them.

I'm well aware that newer versions of these systems have vulnerabilities of their own. I am also guessing that many of the older systems still persist in usage within organizations anyway. However the weight of the study material which is placed on older systems makes me wonder if in the future, penetration testing will necessarily either become less useful or need to shift in its methods as developers become more security conscious in authoring their protocols/apps/OSs, and as their tools become more advanced. E.g., many higher-level languages manage memory for developers, making buffer-overflows much less likely, even for careless developers. Also, it is my perception (though I could very much be wrong, I'm no expert) that modern operating systems are significantly more secure than their predecessors.

I know that ANY system will have SOME flaws somewhere, however it seems that penetration testing as a professional level involves by definition some degree of standardized scanning/exploitation of known vulnerabilities. My question then is, is the surface area which professional penetration testers shrinking, as security-awareness increases among developers of apps/protocols/OSs, and as the built-in security of their tools improve?

I'm not implying that I think penetration testing would ever "go away", but e.g. it might start to rely more on social engineering than actualy technical vulnerabilities in the networks or software.

Answer 1

The objective of penetration testing is not to find vulnerabilities, and so it hasn't failed if it doesn't find any. It's to check whether or not vulnerabilities are present. It doesn't get harder if systems get more secure, it just comes up with fewer vulnerabilities. In fact, it will get easier if the list of known vulnerabilities to check gets smaller.

Answer 2

The vulnerability and IT landscape are constantly changing and I'd say that while some types of issues are getting less prevalant, others take their place as more common, whilst some issues are forever (it seems)

Things like the classic network exploitable issues in widely deployed Operating Systems (e.g. MS08-067) are less common (although the Shadowbrokers dumps showed that they're still a possibility), and where they exist they tend to be harder to exploit as OS makers add more defences to their systesm (e.g. ASLR/DEP etc)

However I don't think that this necessarily means that there won't be issues for testers to find. Some things, like authorisation issues in web applications, are very hard to fix generically across all platforms and rely on individual developers, so they're a possiblity in any application you test.

Also things that rely on large numbers of people getting security right, like good password choices, seem to persist pretty much forever.

Alongside those, new avenues open up for testers to look at. For example, compared to 15 years ago, far more of companies systems are hosted "in the cloud" which can expose them to attack more easily than if they were in an internal enterprise network behind several layers of defensive systems, so there's new ways that testers can look to exploit that.

Testers definitely need to adapt to new systems coming along and old systems going out of fashion, but I don't see that they'll run out of things to find anytime soon.

Answer 3

In my opinion no... I regularly find SQL injections because developers are building their custom applications in PHP instead of using frameworks. The same is true for APIs (especially those for mobile applications in my experience). As for external infrastructure, I would say finding known vulnerabilities (with metasploit modules) is rare, the reason being they would already have been compromised. Probing normally leads to results however, for example I have found printers exposed on the internet with default credentials which allowed for pivoting into the internal network. As for internal infrastructure there are always weaknesses, but using tools like Responder (for LLMNR poisoning) will get you DA like 80% of the time depending on password policies, so you are basically probing other places while Responder is running just in case it doesn't get you a NTLM hash which you can use to escalate to DA.