0

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the transferred malicious code can't be explicitly(i.e. allowed by user) executed.

Can you refer to the description on how this normally happens in reality? I consider only cases when computer user doesn't realize there is something wrong going inside it, and those which are related to code execution.

3

If it's really a bunch of network packets, the target computer has to be somehow vulnerable: there has to be something that interprets these packets in a way it's not supposed. The requirements for such vulnerabilities would be:

  • Vulnerability Type: Execute arbitrary code on vulnerable system.
  • Access Vector: Network (Remote).
  • Authentication: Not required.

We can combine these requirements into a CVE Vulnerability Search to see what kind of monsters they are. The vulnerable piece can be your operating system, the network adapter drivers, any program that listens for connections... The attacks are most likely opportunistic and automated.

Another way to inject malware on insecure (WiFi) networks is a man-in-the-middle attack (MITM). That's not sending a bunch of network packets, but replying to something you requested: the access vector is not the network – it's you.

  • If you are downloading a file on an unencrypted connection someone can replace it with their malware. They can also try to downgrade your connection e.g. by using SSLstrip methods.
  • It's not necessarily you who starts the download: some automatic update can be poorly designed etc.
  • The modified content could be targeted against a browser vulnerability: no need to run an executable.
3

A bunch of network packets does not usually reside in code execution. It can though result in code execution if the software dealing with these packets (i.e. the OS kernel, a specific driver or some application which gets fed the payload) improperly handles the data. Improperly means typically having specific expectations about the data but not ensuring that these expectations are actually met.

Some examples for such attacks at various levels of the software stack:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.