Why are our holes vulnerable?

Why do holes appear in the first place?

Many systems were never built with security as a priority. The early Internet, for example, was designed for connectivity only, without considering security, which left it an open structure [4]. That legacy persists: operating systems and applications are often vulnerable because of design errors, and even when vendors release patches, the fix depends on system administrators actually installing them [4]. When administrators fail to patch on time, systems stay exposed to exploitation by hackers [4].

Holes also come from implementation and management mistakes, not just design flaws [4]. A vulnerability is simply a hole or weak point that can be exploited to compromise a system's security [4]. In practice, that can mean a software bug, a misconfigured setting, or a missing update—each one a potential entry point.

What does a hole actually look like in a real system?

In a network perimeter, a hole is a gap that penetrates through defenses, while a backdoor is a separate unsecured entry point that bypasses them [1]. Both compromise the perimeter's ability to keep intruders out [1]. On a website, a security hole can function as a backdoor for attackers to reach the victim's system; developers often ignore website security, especially on small or company-profile sites that may hold stealable data [5].

Holes are not limited to traditional computers. In drone camera systems, exploiting security vulnerabilities and software bugs can allow covert, per-direction control over drone communication [2]. Even though advanced Wi-Fi protocols have improved, age-old vulnerabilities still permit denial-of-service and other cyber-attacks [2]. In tests on a DJI Tello drone, exploiting camera security holes significantly disrupted the drone's command-and-control capability [2].

Why do known holes stay open?

One reason is that fixing them relies too heavily on manual effort. Software vendors release patches for discovered vulnerabilities and depend on system administrators to accept and install them, but many administrators fail to do so on time [4]. The scale of the problem is large: an average of 115 vulnerabilities per week were documented during 2005, and existing vulnerability-management methods have failed to manage the problem comprehensively [4].

Another reason is that holes can be built into services that are meant to be convenient. Smart DNS services, which let users access geofenced video content by redirecting traffic through proxy servers inside the allowed region, create privacy vulnerabilities—described as holes in the geofence—because the mechanism that bypasses geographic restrictions can be exploited [3]. The service works by having users change only their DNS settings, with no software installation, which makes it simple to use but also simple to abuse [3].

Can holes be closed before attackers find them?

Yes, but it requires actively looking for them. Vulnerability assessment is a scanning process to find vulnerabilities and loopholes in a website system; once a hole is identified, a developer can make changes or add scripts to close it and protect data integrity [5]. Tools such as OWASP ZAP can search for security holes in a website system, giving developers the information they need to fix them [5].

For networked systems more broadly, automated management has been proposed to address the awareness and patch-deployment problems that manual methods leave unresolved [4]. One framework, AVMS (Automated Vulnerability Management System), is designed to filter and prioritize relevant vulnerability messages, then download and deploy the associated patches to the required machines [4]. A proof-of-concept prototype suggested that this automated approach is viable [4]. For drone systems specifically, the findings point to a need for further investigation and patch development [2].

Sources used in this answer

Related research questions